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Abstract 

Electoral control refers to attempts by an election's organizer ( "the chair" ) to influ- 
ence the outcome by adding/deleting/partitioning voters or candidates. The ground- 
breaking work of Bartholdi, Tovey, and Trick [2] on (constructive) control proposes 
computational complexity as a means of resisting control attempts: Look for election 
systems where the chair's task in seeking control is itself computationally infeasible. 

We introduce and study a method of combining two or more candidate-anonymous 
election schemes in such a way that the combined scheme possesses all the resistances 
to control (i.e., all the NP-hardnesses of control) possessed by any of its constituents: It 
combines their strengths. From this and new resistance constructions, we prove for the 
first time that there exists an election scheme that is resistant to all twenty standard 
types of electoral control. 
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1 Introduction 



Elections are a way of, from a collection of voters' (or agents') individual preferences over 
candidates (or alternatives), selecting a winner (or outcome). The importance of and study 
of elections is obviously central in political science, but also spans such fields as economics, 
mathematics, operations research, and computer science. Within computer science, the 
applications of elections are most prominent in distributed AI, most particularly in the 
study of multiagent systems. For example, voting has been concretely proposed as a com- 
putational mechanism for planning |3|4j and has also been suggested as an approach to 
collaborative filtering [5]. However, voting also has received attention within the study 
of systems. After all, many distributed algorithms must start by selecting a leader, and 
election techniques have also been proposed to attack the web page rank aggregation prob- 
lem and the related issue of lessening the spam level of results from web searches [6|7| . 
Indeed, in these days of a massive internet with many pages, many surfers, and many 
robots, of intracorporate decision-making potentially involving electronic input from many 
units /individuals /warehouses /trucks /sources, and more generally of massive computational 
settings including many actors, it is easy to note any number of situations in which elections 
are natural and in which the number of candidates and/or voters might be massive. For 
example, suppose amazon.com were to select a "page of the week" via an election where 
the candidates were all its web pages and the voters were all visiting surfers (with prefer- 
ences inferred from their page- viewing times or patterns); such an election would have an 
enormous number of candidates and voters. All these applications are exciting, but imme- 
diately bring to a theoretician's mind the worry of whether the complexity of implementing 
election systems is satisfyingly low and whether the complexity of distorting (controlling or 
manipulating) election systems is reassuringly high. 

Along these lines, though in a time when the importance of large-scale elections was 
less crystal clear than it is today, a remarkable series of papers by Bartholdi, Orlin, Tovey, 
and Trick |8)9)10)2j pioneered the study of the complexity of the winner, control, and 
manipulation problems for election systems (see [IT] for a related survey). Of these, the 
winner and manipulation problems have since been studied particularly intensely. It is 
known, for example, that even for some quite natural, simple-to-state election systems — 
such as those of Lewis Carroll |12j . Kemeny (see |13|). and Young |14|15j — checking whether 
a given candidate wins is complete for the "parallel access to NP" level of the polynomial 
hierarchy |16|17|18j . 

Since the complexity of elections is a topic whose importance has made itself clear, it is 
natural to ask whether the standard tools and techniques of complexity-theoretic study exist 
in the context of elections. One important technique in complexity is the combination of 
problems. For example, for sets in complexity theory, a standard approach to combination 
is the join (also known as the disjoint union and as the marked union): A © B = {Ox \ 
x G A} U {ly j y G B}. Even this simple example is not as innocent as it seems. Though 
the join indeed has many nice properties regarding respecting simplicity (e.g., if A G P 
and B G P, then A © B G P) and preserving hardness (e.g., if C <m A or C <m B, 
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then C <m A (B B), it is known that the join has the quite unexpected ability of lower 
complexity within the extended low hierarchy ([H]; that result should probably best be 
taken as suggesting that the definition of the extended low hierarchy — back in 1986 [20J — 
was itself somewhat unnatural, or at least left itself open to this unusual behavior). 

In some sense, our work in this paper can be thought of as simply providing, for elec- 
tions, an analog of the join. That is, we will propose a method of combining two (or 
more) elections in a way that will maintain desirable simplicity properties (e.g., if all of the 
constituent elections have polynomial-time winner algorithms then so will our combined 
election) while also inheriting quite aggressively desirable hardness properties (we will show 
that any resistance-to-control — in the sense that is standard [2] and that we will provide a 
definition of later — possessed by even one of the constituent elections will be possessed by 
the combined election). One cannot directly use a join to achieve this, because the join of 
two sets modeling elections is not itself an election. Rather, we must find a way of embed- 
ding into election specifications — lists of voter preferences over candidates — triggers that 
both allow us to embed and switch between all the underlying election systems and to not 
have such switching go uncontrollably haywire when faced with electoral distortions such 
as adding/deleting/partitioning voters/candidates, since we wish hardness with respect to 
control by such mechanisms to be preserved. 

We above have phrased this paper's theme as the development of a way of combining 
multiple election systems — and in doing so, have desirable types of simplicity/complexity 
inheritance. However, this paper also has in mind a very specific application — both for its 
own interest and as a sounding board against which our election hybridization scheme can 
be tested. This application is the control of election systems. 

In election control, we ask whether an election's organizer (the chair) can by some 
specific type of manipulation of the election's structure (adding/deleting/partitioning vot- 
ers/candidates) cause a specified candidate to be the (unique) winner. As mentioned earlier, 
the complexity-theoretic study of control was proposed by Bartholdi, Tovey, and Trick in 
1992 [2]. We will closely follow their model. In this model, the chair is assumed to have 
knowledge of the vote that will be cast by each voterj^ and there are ten different types 
of control (candidate addition, candidate deletion, voter addition, voter deletion, partition 
of candidates, run-off partition of candidates, and partition of voters [2] — and for each of 
the three partition cases one can have subelection ties promote or can have subelection ties 
eliminate, see [21]). 

Though Bartholdi, Tovey, and Trick's control paper is lovely and powerful, very few 
subsequent papers have extended beyond their results. One particular one that has is a 

1 [2], in this regard, takes the view that all voters vote sincerely, and makes the good point regarding the 
chair's global knowledge that such global knowledge is perhaps not a realistic assumption but rather is a 
"conservative" one — that they show that even in the face of an omniscient chair, the control problems for 
certain voting systems are intractable. We heartily agree with the latter point, but regarding the former 
point mention that one does not need to assume voter sincerity. Rather, their model simply assumes that 
the chair knows how each voter will vote, and it is irrelevant whether such votes are or are not sincere — at 
least if our model is that the votes are fixed before the chair makes his or her decisions regarding how to 
assert control. 
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paper of Hemaspaandra, Hemaspaandra, and Rothe [21 J that asks the same questions for 
destructive control, i.e., when the chair's goal is to preclude a given candidate from being the 
(unique) winner. (One might ask if such study is a waste of time, given that any sane chair 
would vastly prefer to choose the winner than to just keep some particular hated choice 
from being the winner. However, [2T] shows that for some standard election systems and 
types of control the former problem is intractable yet the latter is in P. That is, spoiling a 
candidate's chances can be easier than outright controlling who wins.) 

Of course, the dream case would be to find an election system that has the desirable 
property of having a polynomial-time algorithm for evaluating who won, but that also has 
the property that for every single one of the twenty standard types of control (namely, 
the standard ten types, each for the constructive and destructive cases) it is computation- 
ally infeasible (NP-hard) to assert such control. Unfortunately, no system yet has been 
proven resistant to all twenty types of control. In fact, given that broad "impossibility" re- 
sults exist for niceness of preference aggregation systems (e.g., Arrow's Theorem [22J) and 
for nonmanipulability of election systems (e.g., the Gibbard-Satterthwaite and Duggan- 
Schwartz Theorems ([23,24 25j, see also [26J ) ) , one might even momentarily wonder whether 
the "dream case" mentioned above can be proven impossible via proving a theorem of the 
following form: 

"For no election system whose winner complexity is in P are all twenty types of 
control NP-hard." 

However, such a claim is proven impossible by our work: Our hybrid system in fact will allow 
us to combine all the resistance types of the underlying elections. And while doing so, it will 
preserve the winner-evaluation simplicity of the underlying elections. Thus, in particular, 
we conclude that the "dream case" holds: There are election systems — for example, our 
hybridization of plurality, Condorcet, and an election system we call £ n ot-ari-one (which will 
be defined in Section [3T2]) — that are resistant to all twenty types of control (Theorem 13. lip . 

This paper (in its conference version) was the first to prove any election system to be 
resistant to even the ten constructive control types. And it was only in 2008, in the work 
of [27], that it was shown that some natural system also had those ten constructive-control 
resistances. (The largest resistance count among the twenty standard control types that 
has yet been obtained by any work other than that of the present paper — which obtains 
all twenty resistances — was obtained by Erdelyi, Nowak, and Rothe [28], who proved that 
a variant of approval voting has seventeen of the twenty resistances. However, to do so 
that paper adopts a different model — one in which each voter's preference consists of both 
a strict ordering and an approval vector.) It remains an open issue whether any previously 
studied (i.e., "natural") system has all twenty resistances. 

Our hybridization system takes multiple elections and maintains their simplicity while 
inheriting each resistance-to-control possessed by any one of its constituents. Thus, it in 
effect unions together all their resistances — thus the "broaden" of our title! The work most 

2 We mention that in the quite different setting of election manipulation (which regards not actions by 
the chair but rather which regards voters altering their preferences in an attempt to influence who becomes 
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closely related to that of this paper is the constructive control-defining work of Bartholdi, 
Tovey, and Trick [2j, the destructive control-defining work of Hemaspaandra, Hemaspaan- 
dra, and Rothe [21) . and the control studies of Erdelyi, Nowak, and Rothe |31|28j . Fal- 
iszewski et al. |32|27j . and Procaccia, Rosenschein, and Zohar [33]. Work on bribery is 
related to this paper, in the sense that bribery can be viewed as sharing aspects of both 
manipulation and control |34|35[ . Of course, all the classical |8|9|10| and recent papers 
(of which we particularly point out, for its broad framework and generality, the work of 
Spakowski and Vogel |36j) on the complexity of election problems share this paper's goal of 
better understanding the relationship between complexity and elections. 

This paper is organized as follows. Section [2] provides the needed definitions regarding 
elections and control, defines and discusses our hybridization system, and defines and dis- 
cusses the notions of inheritance that we will use to measure whether or not hybridization 
maintains or destroys desirable properties. Section [3] discusses the behavior of our hybrid 
system with respect to inheriting resistance (NP-hardness) to control, and also discusses 
the related notion of inheritance of susceptibility. Then it discusses the inheritances and 
noninheritances of our hybrid system with respect to vulnerability (having P-time control 
algorithms) , and also discusses the related notion of immunity. Appendix [A] presents some 
proofs deferred from Section [3,41 

2 Elections, Control, Hybridization, and Inheritance: Defi- 
nitions and Discussion 

2.1 Elections 

An election system (or election rule or election scheme or voting system) £ is simply a map- 
ping from (finite though arbitrary-sized) sets (actually, mathematically, they are multisets) 
V of votes (each a preference order — strict, transitive, and complete — over a finite candidate 

the winner) [9], there has been some work by Conitzer and Sandholm [29] regarding making manipulation 
hard, even for systems where it is not hard, by changing the system by going to a two-stage election in which 
a single elimination pre-round is added, and Elkind and Lipmaa [30] have generalized this to a sequence 
of elimination rounds conducted under some system(s) followed by an election under some other system. 
Though the latter paper like this paper uses the term "hybrid," the domains differ sharply and the methods 
of election combination are nearly opposite: Our approach (in order to broaden resistance to control) embeds 
the election systems in parallel and theirs (in order to fight manipulation) strings them out in sequence. 
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seel) to (possibly empty, possibly nonstrict) subsets of the candidatesO All votes in a given 
V are over the same candidate set, but different V's of course can be over different (finite) 
candidate sets. Each candidate that for a given set of votes is in £'s output is said to be a 
winner. If for a given input E outputs a set of cardinality one, that candidate is said to be 
the unique winner. Election control focuses on making candidates be unique winners and 
on precluding them from being unique winners. 

Throughout this paper, a voter's preference order will be exactly that: a tie-free linear 
order over the candidates. And we will discuss and hybridize only election systems based 
on preference ordersi! Following a convention that dates at least back to the early 1980s, 
we often will refer to the elements of V as "voters" rather than "votes." 

We now define two common election systems, plurality voting and Condorcet voting. In 
plurality voting, the winners are the candidates who are ranked first the most. In Condorcet 
voting, the winners are all candidates (note: there can be at most one and there might be 
zero) who strictly beat each other candidate in head-on-head majority-rule elections (i.e., 
get strictly more than half the votes in each such election). For widely used systems such 

3 A subtle point is that, to be very careful, we should mention that though we above speak of £ as if its 
input was just the votes (over a candidate set), to be utterly formal we tacitly view the candidate set itself 
as being also an input. It might be natural to think that taking such a view is unneeded, since we can infer 
the candidate set from the votes. However, that reasoning fails — though this boundary case seems to have 
been overlooked in some earlier work — if the cardinality of the vote set is zero. For example, the election 
rule under which all candidates always win very fundamentally needs to, when there are zero voters, know 
what the candidate set is, so it can know what winner names to output. Nonetheless, we will be careful in 
defining our hybrid scheme not to take unfair advantage of the fact that C is part of our input, formally 
speaking. 

In the context of subelections we will sometimes speak of elections (C, V) where C is a strict subset of the 
candidates that occur in V . In such cases, we view the preference orders in V as being restricted to C. 

4 As is typical in papers on the complexity of voting, we study the case not of elections (actually, full- 
blown social choice functions) that output a full preference order (except with ties allowed), but rather we 
study the bare-bones but in practice very central case of elections where the focus is purely on selecting the 
winners. 

As a somewhat arcane side comment, we mention that though many earlier papers imply that the latter is 
a special case of the former, this is not strictly true unless one restricts oneself to election rules always having 
at least one winner. Without that restriction, the problem is that the trick of declaring the top equality 
group of an output "preference order except with ties allowed" to be the winners breaks down since it has 
no way to declare that there are no winners (note that having all be equal would make them all winners; of 
course, we could when there are three or more candidates use, for example, c > b > a to code both c > b > a 
and c > a > b, since they both have the same winner set, "{c}," and we would thus free up c > a > b to 
denote "special case: no one wins" . . . but this is such an exceedingly unnatural approach that we would not 
want to say that it shows that winner/loser elections with three or more candidates are a "special case" of 
general social choice functions). 

Thus we do not directly discuss systems such as approval voting that take very different inputs: lists 
tagging each candidate as approved or not approved. However, we mention in passing that our hybridization 
approach works perfectly well for such systems and for them yields — if one codes the input as candidate 
lists tagged with an approval/disapproval bit — the same main results: The hybrid inherits all the resistance 
types of its constituent systems and yet has a polynomial-time winner algorithm if they all do. Thus the only 
reason we throughout this paper fix our systems as having preference orders as inputs is that it wouldn't 
even be particularly meaningful to try to hybridize together systems with conflicting input types, and by 
focusing just on preference-order-based preferences we prevent that from ever happening. 
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as plurality voting, we will write plurality rather than £ p i U raiity • 

We say that an election system £ is candidate- anonymous if for every pair of sets of 
votes V and V , \\V\\ = \\V'\\, such that V can be created from V by applying some one-to- 
one mapping h from the candidate names in V onto new candidate names in V (e.g., each 
instance of "George" in V is mapped by h to "John" in V and each instance of "John" in 
V is mapped by h to "Hillary" in V' and each instance of "Ralph" in V is mapped by h to 
"Ralph" in V) it holds that 

£(V) = {c> | (3ce£(V))[h(c)=c'}}. 

Informally put, candidate-anonymity says that the strings we may use to name the candi- 
dates are all created equal. Note that most natural systems are candidate-anonymous. For 
example, both the election systems mentioned immediately above — plurality-rule elections 
and the election system of Condorcet — are candidate-anonymous. 

We mention that everywhere in this paper where we use assumptions of candidate- 
anonymity (namely, in most of our inheritance results), our results would even hold under 
the far weaker assumption of candidate-affine-invariance, defined as follows E We say that 
an election system £ is candidate- affine-invariant if for every pair of sets of votes V and V 
such that V' can be created from V by applying some mapping h of the form h(c) = k\c+k2, 
k\ £ N + , &2 £ N, from the candidate names in V to the new candidate names in V', it 
holds that £(V) = {c' \ (3c E £(V)) [h(c) = c']}. Note that when we treat candidate 
names as natural numbers (both above, and also later in defining our hybrid scheme), we 
are implicitly using the standard bijection between strings from S* (potential candidate 
names) and natural numbers, namely the ith string in lexicographical order is associated 
with the natural number i— 1. Though as just mentioned candidate-affine-invariance suffices 
for all our results, we nonetheless use candidate-anonymity in our definitions and statements 
as candidate-anonymity seems a more natural notion. To avoid any confusion, we stress 
that ki is limited to N + and k2 is limited to N, and so we are using the term "affine" 
somewhat improperly. 

Finally, we mention that though related in flavor, candidate-anonymity is not identi- 
cal to the political science notion of (candidate-)neutrality (see [22]) . which is defined by 

6 One should be a bit careful here. In many such cases, our existing proof already handles the case 
of candidate-affine-invariance, since the existing proof uses a transform of the form used in defining (as 
we are about to do in the main text) candidate-affine-invariance: h(c) = fcic + ki, fci S N + , fca 6 N. 
However, in some cases, rethinking the result in terms of candidate-affine-invariance requires revising the 
proof, most typically to either explicitly invoke the type of mapping used in defining candidate-affine- 
invariance, or to change the words "candidate-anonymous" /"candidate-anonymity" to the words "candidate- 
affinc-invariant" / "candidate-affine-invariance" in some places, or to keep in mind that when considering this 
change one also should view all the underlying definitions — such as inheritance — as being framed in terms 
of candidate-affine-invariance (though, of course, in any case candidate-anonymity implies candidate-affine- 
invariance, so the remapping of the definition of inheritance is not truly needed when the inheritance appears 
only in the hypothesis of a particular theorem). As a specific example, note that to make Theorem 13. 121 s 
proof work for the case of candidate-affine-invariance, one would have to create that proof's set D from that 
proof's set C not by just using any mapping that ensures that D and C are disjoint, but rather by choosing 
a mapping that achieves disjointness and that also has the form h(c) — k\c + kz, k\ S N + , &2 G N; this can 
easily be done, e.g., by taking fei = f and sufficiently large. 
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saying that permuting the names of an election's candidates does not affect the outcome|H 
Candidate-anonymity implies neutrality but the converse does not in general hold as shown 
by the following example. The election system that ignores all the votes and declares all 
candidates winners if all candidates' names viewed as strings are of the same length and 
otherwise declares no candidates winners is neutral but not candidate-anonymous ("Bob" 
and "Joy" both win in the two-candidate election with (irrelevant) vote set V but changing 
"Bob" to "Bobby" changes the outcome). Candidate-anonymity, with its view of names as 
being coded as arbitrary strings, is a more "computer science" -y notion — focusing on actual 
codings, since sets are defined via (and machines accept) actual coded input strings. 

2.2 Our Hybridization Scheme: Definition and Discussion 

We now define our basic hybridization scheme, hybrid. To avoid long discussions about what 
properties of what we will call the "default" election rule are not needed or not inherited, 
we will first define a more general scheme, hybrid-base, and then will in defining hybrid 
simply fix the "default" election rule to be the same as the last regular constituent election 
rule. By doing so, our results will be stated in slightly less general ways than what actually 
holds, but the theorem statements will be simpler and clearer. 

Definition 2.1 Let £o,£i, . . . ,£k—i> an d ^default be election rules that take as input voters' 
preference orders. We define hybrid-base(£o, £\, . . . , £k-i, ^default) to be the election scheme 
that does the following: 

If there is at least one candidate and all candidate namejf] are congruent, mod- 
ulo k, to i (for some i, < i < k — 1) then use election rule £{. Otherwise use 

^default ■ 

We define hybrid(£o, £\, . . . , £k-i) to be the system hybrid-base(£o, £\, . . . , £k~i,£k-i)- We 
say that £q, £\, . . . , £k-i are the constituents of hybrid{£$,£i, . . . , £k-i)- 

Having defined our system there is much to discuss. Why did we choose this system? 
What are its properties? What other approaches did we choose not to use, and why? What 
aspects of the input is our method for switching between election systems using, and what 
aspects is it choosing not to exploit, and what are the costs associated with our choices? 

As to the properties of this system, Section [3] is devoted to that, but most crucially we 
will see that this system possesses every resistance-to-control property possessed by even 
one of its constituents. And this will hold essentially due to the fact that hybrid is a close 
analog of the effect of a join: It splices the constituents together in such a way that key 

7 Arrow [22] cites the origin of this notion to a paper by Guilbaud [37] and defines the Condition of Neu- 
trality as follows: "Let T(x) be a one-one transformation of the set of alternatives into itself which preserves 
all individual orderings. Let the environment S be transformed into S' by the transformation T. Then the 
social choice from 5*, C(S), is transformed by T into the social choice, C'(S'), from the environment 5"." 

8 Viewed as natural numbers via the standard bijection between E* and N mentioned in the discussion of 
candidate- anonymity. 
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questions about the constituent systems can easily be many-one polynomial-time reduced 
(<m-reduced or reduced, for short) to questions about their hybrido 

As to why we chose this particular system, note that hybrid "switches" between con- 
stituent systems via wildly redundant information. This will let us keep deletions/partitions 
of voters/candidates from causing a switch between the underlying systems (if the starting 
state routed us to a nondefault case). Note that some other approaches that one might 
take are more sensitive to deletions. For example, suppose we wanted to hybridize just 
two election systems and decided to do so by using the first election system exactly if the 
first voter's most disliked candidate's name is lexicographically less than the first voter's 
second-most-disliked candidate's name. Note that if, as part of our control problem, that 
voter is deleted, that might suddenly change the system to which the problem is routed. 
Or, as another example, if we use the modulo k value of the name of the lexicographically 
smallest candidate to control switching between the k election systems, then that hybridiza- 
tion approach would be very sensitive to jumping between systems if, as part of our control 
problem, that candidate is deleted. These examples give some idea of why we chose the 
approach we did, though admittedly even it can in some cases be nudged into jumping 
between systems — but at least this happens in very limited, very crisply delineated cases 
and in ways that we will generally be able to appropriately handle. 

Finally, we come to what we allow ourselves to use to control the switching, what we 
choose not to use, and what price we pay for our choices. What we use (as is allowed in 
the [2] model) are the candidates' names and only the candidates' names. We use absolutely 
nothing else to control switching between elections. We do not use voters' names. Indeed, in 
the [2] model that we follow, voters (unlike candidates) do not even have names. But since 
the votes are input as a list, their ordering itself could be used to pass bits of information — 
e.g., we could look at whether the first vote in the list viewed as a string is lexicographically 
less than the last vote in the list viewed as a string. We in no way "cheat" by exploiting such 
input-order information, either for the votes or for the list of candidates (as per Footnote El 
and as per [2], formally the candidate set is passed in separately to cover a certain boundary 
case). Our "switch" is based purely on candidates' names and just candidates' names. This 
also points to the price we pay for this choice: Even when all its constituent elections are 
candidate-anonymous, hybrid may not possess candidate-anonymity. 

2.3 Types of Constructive and Destructive Control 

Constructive control problems ask whether a certain class of actions by the election's chair 
can make a specified candidate the election's unique winner. Constructive control was first 
defined and studied by Bartholdi, Tovey, and Trick [2]. Destructive control problems ask 
whether a certain class of actions by the election's chair can make a specified candidate 
fail to be a unique winner of the election. Destructive control was defined and studied by 
Hemaspaandra, Hemaspaandra, and Rothe [38)21] . and in the different context of electoral 

9 We mention in passing that this is one of the reasons we focus on hybrid rather than hybrid-base. 
It is possible to construct artificial systems for which even the winner problem for a system £o does not 
<^-reduce to hybrid-base(£o, £i, . . . , £j._i,£d). 
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manipulation destruction was introduced even earlier by Conitzer, Lang, and Sandholm |39l 

nam. 

Bartholdi, Tovey, and Trick's [2] groundbreaking paper defined seven types of electoral 
control. Among those seven, three are partition problems for which there are two different 
natural approaches to handling ties in subelections (see [21] which introduced these tie- 
handling models for this context): eliminating tied subelection winners (the "TE" model) 
or promoting tied subelection winners (the "TP" model). Thus, there are (7 — 3) + 2 -3 = 10 
different standard types of constructive control, and there are essentially the same ten types 
of destructive control. 

Since it is exceedingly important to not use a slightly different problem statement than 
earlier work whose results we will be drawing on, we will state the seven standard construc- 
tive control types (which become ten with the three partition control types each having 
both "TE" and "TP" versions) and their destructive analogs using word-for-word defini- 
tions from [21 3 8)42"] . which themselves are based closely and often identically on [2] (see 
the discussion in [2Tj ) . 

Though V, the set of votes, is conceptually a multiset as in the previous related work, 
we take the view that the votes are input as a list ("the ballots"), and in particular are 
not directly input as a multiset in which cardinalities are input in binary (though we will 
mention later that our main result about hybrid holds also in that quite different model). 

Control by Adding Candidates 

As is common, we state our decision problems as "Given" instances, and a related Yes/No 
question. The language in each case is the set of all instances for which the answer is 
Yes. (So we are studying the complexity of recognizing the set of instances on which 
control is possible.) Since in each control scenario, the "Given" instance is identical for the 
constructive and the destructive case, we state it just once and then state the corresponding 
two questions, one for constructive and one for destructive control. 

Given: A set C of qualified candidates and a distinguished candidate c G C, a set D of 
possible spoiler candidates, and a set V of voters with preferences over C L) D. 

Question (constructive): Is there a choice of candidates from D whose entry into the 
election would assure that c is the unique winner? 

Question (destructive): Is there a choice of candidates from D whose entry into the 
election would assure that c is not the unique winner? 

This problem captures whether adding candidates can make a candidate the victor or can 
block such 1^1 

The notion, as we have stated it, is the notion proposed by Bartholdi, Tovey, and Trick [5] as "Adding 
Candidates." However, [32127] recently defined and highly commended an eleventh control type — adding a 
number of candidates for the "limited" case where a bound on the maximum number of candidates that 
can be legally added is itself part of the input. We mention that the techniques of the current paper apply 
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Control by Deleting Candidates 

Given: A set C of candidates, a distinguished candidate c £ C, a set V of voters, and a 
positive integer k < \\C\\. 

Question (constructive): Is there a set of k or fewer candidates in C whose disqualifica- 
tion would assure that c is the unique winner? 

Question (destructive): Is there a set of k or fewer candidates in C — {c} whose disqual- 
ification would assure that c is not the unique winner? 

This problem models vote suppression. (The choice to have a k for candidate deletion 
and voter addition/deletion but not for candidate addition is somewhat arbitrary, but was 
a decision made explicitly by Bartholdi, Tovey, and Trick [2J, and for consistency and 
comparison purposes, we follow their choice.) Note that deleting the distinguished candidate 
c in the destructive case, which would trivialize the problem, is not allowed. 

Control by Partition of Candidates 

Given: A set C of candidates, a distinguished candidate c € C, and a set V of voters. 

Question (constructive): Is there a partition of C into C\ and C2 such that c is the 
unique winner in the sequential two-stage election in which the winners in the sub- 
election (Ci, V) who survive the tie-handling rule move forward to face the candidates 
in C2 (with voter set V)? 

Question (destructive): Is there a partition of C into C\ and C2 such that c is not the 
unique winner in the sequential two-stage election in which the winners in the sub- 
election (Ci, V) who survive the tie-handling rule move forward to face the candidates 
in C2 (with voter set V)? 

Control by Run-off Partition of Candidates 

Given: A set C of candidates, a distinguished candidate c G C, and a set V of voters. 

Question (constructive): Is there a partition of C into C\ and C2 such that c is the 
unique winner of the election in which those candidates surviving (with respect to the 
tie-handling rule) subelections (Ci, V) and (C2, V) have a run-off with voter set VI 

perfectly well to that case too, and so in particular the techniques of the present paper easily yield that there 
is a hybrid election system that is resistant to all twenty-two control types (the twenty standard ones plus 
the constructive and destructive limited-candidate-addition cases). The reason we can make this comment is 
that there are systems resistant to constructive limited-candidate-addition and there are systems resistant to 
destructive limited-candidate-addition; for example, plurality has both these properties (see the discussion 
in the caption of Table 1 of [43]). 
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Question (destructive): Is there a partition of C into C\ and C2 such that c is not the 
unique winner of the election in which those candidates surviving (with respect to the 
tie-handling rule) subelections (Ci, V) and (C2, V) have a run-off with voter set V? 

These two problems model two natural ways of conducting partitioned elections: either via 
an elimination pre-round involving some candidates or as a run-off structure (3-node tree). 

Control by Adding Voters 

Given: A set of candidates C and a distinguished candidate c G C, a set V of registered 
voters, an additional set W of yet unregistered voters (both V and W have preferences 
over C), and a positive integer k < \\W\\. 

Question (constructive): Is there a set of k or fewer voters from W whose registration 
would assure that c is the unique winner? 

Question (destructive): Is there a set of k or fewer voters from W whose registration 
would assure that c is not the unique winner? 

Control by Deleting Voters 

Given: A set of candidates C, a distinguished candidate c € C, a set V of voters, and a 
positive integer k < \\V\\. 

Question (constructive): Is there a set of k or fewer voters in V whose disenfranchise- 
ment would assure that c is the unique winner? 

Question (destructive): Is there a set of k or fewer voters in V whose disenfranchisement 
would assure that c is not the unique winner? 

Control by Partition of Voters 

Given: A set of candidates C, a distinguished candidate c <G C, and a set V of voters. 

Question (constructive): Is there a partition of V into V\ and V2 such that c is the 
unique winner in the hierarchical two-stage election in which the survivors of (C, Vi) 
and (C, V2) run against each other with voter set VI 

Question (destructive): Is there a partition of V into V\ and V2 such that c is not the 
unique winner in the hierarchical two-stage election in which the survivors of (C, V± ) 
and (C, V2) run against each other with voter set VI 

These three problems model control by addition, deletion, and partition of voters. 
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2.4 Immunity, Susceptibility, Vulnerability, and Resistance 

Again, to allow consistency with earlier papers and their results, we take this definition from 
[21|38 42 j. with the important exception regarding resistance discussed below Definition (2T2j 
It is worth noting that immunity and susceptibility both are "directional" (can we change 
this?) but that vulnerability and resistance are, in contrast, outcome-oriented (can we end 
up with this happening?) and complexity- focused. 

Definition 2.2 We say that a voting system is immune to control in a given model of 
control (e.g., "destructive control via adding candidates") if the model regards constructive 
control and it is never possible for the chair to by using his/her allowed model of control 
change a given candidate from being not a unique winner to being the unique winner, or the 
model regards destructive control and it is never possible for the chair to by using his/her 
allowed model of control change a given candidate from being the unique winner to not being 
a unique winner. If a system is not immune to a type of control, it is said to be susceptible 
to that type of control. 

A voting system is said to be (computationally) vulnerable to control if it is susceptible 
to control and the corresponding language problem is computationally easy (i.e., solvable in 
polynomial time). 

A voting system is said to be resistant to control if it is susceptible to control but the 
corresponding language problem is computationally hard (i.e., NP-hard). 

We have diverged from all previous papers by defining resistance as meaning NP- 
hardness (i.e., NP-<m-hardness) rather than NP-completeness (i.e., NP-<m-completeness). 
Though revising existing notions always holds the danger of sowing confusion, in this partic- 
ular case the redefinition is compelling. Under the [2] "NP-complete" definition, a problem 
whose control issue is NP-complete is resistant but a problem whose control issue is NEEEE- 
complete — or even undecidable — would actually be provably not resistant. This is totally 
at odds with the intent of the notion of being resistant to control. In [2j, all their prob- 
lems happened to be not just NP-hard but also NP-complete, but that certainly is not a 
reason to define a "difficulty level" concept in terms of a notion — NP-completeness — that 
encapsulates both a difficulty notion (NP-hardness) and a simplicity notion (membership 
in NP). 

Thus we redefine resistance to mean NP-hardness. This redefinition was already praised, 
though not adopted, in [21, Footnote 9]. Note that all existing resistance results (under the 
old definition) imply resistance under the new definition — which should lessen the potential 
for confusion. 

As a final comment on this redefinition, we above casually mentioned that control prob- 
lems might in difficulty exceed NP-completeness. But can that really occur in truly natural 
systems? The answer is yes. In particular, note that the unique winner problem for any 
election system (with preference orders) reduces to its constructive control by adding can- 
didates problem (by setting the spoiler candidate set D to 0), to its constructive control 
by deleting candidates problem (by setting the deletion limit k to 0), to its constructive 
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control by adding voters problem (by setting the addition bound /c to 0), and to its construc- 
tive control by deleting voters problem (by setting the deletion limit k to 0). Thus every 
system with a hard winner problem has four control problems that are at least as hard. 
Note that Dodgson [12], Kemeny [13], and Young [14|15j elections are much-studied natural 
systems whose winner problem (but defined in terms of "winner," not "unique winner") is 
known — respectively due to [16], [18] ; and [T7] — to be complete for the G2 level [44|45j of 
the polynomial hierarchy (a level that contains NP, coNP, and the boolean hierarchy [46J, 
so if even one Og-hard set is NP-complete then the polynomial hierarchy collapses to NP). 
From this and the above comments, it follows that the four mentioned control problems are 
OrJ-hard for each of Dodgson, Kemeny, and Young elections when the control problems are 
altered to speak of "winner" rather than "unique winner" (this alteration is not the model 
of this paper or any previous paper on control). However, we observe by close inspection 
that in all of |16|18|17] , the proofs that establish ©^-hardness for the Dodgson, Kemeny, 
and Young election winner problems can be modified to show that their unique winner 
problems are also O^-hardO Thus, we may state the following. 



As mentioned above, the winner problems for Dodgson [12| . Kemeny |13| . and Young [14115] elections 
are known — respectively due to |16j . |18| . and [17] — to be complete for Of, the complexity class capturing 
"parallel access to NP." In this footnote, we show the analogous results for the unique winner problems. 
(See the above papers and [8] for the definitions of these three election systems and of Dodgson score.) 

Theorem 2.3 The unique winner problem for Dodgson elections is Q^-complete. The unique winner prob- 
lem for Kemeny elections is Q^-complete. The unique winner problem for Young elections is Q^-complete. 

Proof. Of -completeness of the winner problem for Dodgson elections was shown in [16]. The Of upper 
bound is easy to show, and the same argument can be used to show a Of upper bound for the unique winner 
problem. It remains to show that the unique winner problem for Dodgson elections is Of-hard. ©f-hardness 
of the winner problem for Dodgson elections was shown by a reduction from the Of-hard problem Two- 
Election Ranking (2ER, for short) [IB]: Given two Dodgson triples (C, c, V) and (D, d, W), where both ||V|| 
and | W|| are odd and c 7^ d, is the Dodgson score of c in (C, V) less than or equal to the Dodgson score of 
d in (D, W)? A Dodgson triple (C, c, V) is an election (C, V) with a designated candidate c £ C. 

The reduction from 2ER to the winner problem for Dodgson elections [IB] has the property that if an 
instance I = ((C, c, V), (D, d, W)) of 2ER is mapped to the Dodgson triple (C, c, V), then c and d are winners 
of (C7, V) if / is in 2ER, and d is the unique winner of (C, V) if / is not in 2ER. It follows that / is in 2ER 
if and only if d is not the unique Dodgson winner of (C , V). Thus the complement of the unique winner 
problem for Dodgson elections is Of-hard. Since Of is closed under complement, the unique winner problem 
for Dodgson elections is also Of-hard. 

Of -completeness of the winner problem for Kemeny elections was shown in [18] . The Of upper bound is 
easy to show, and the same argument can be used to show a Of upper bound for the unique winner problem. 
It remains to show that the unique winner problem for Kemeny elections is Of-hard. Of-hardness of the 
winner problem for Kemeny elections was shown by a reduction from the Of-hard problem Feedback Arc 
Set Member [18] : Given an irreflexive and antisymmetric digraph G and a vertex c of G, does there exist 
a minimum-size feedback arc set of G that contains all arcs entering c? A feedback arc set of G is a set of 
arcs that contains at least one arc from every cycle in G. 

The reduction from Feedback Arc Set Member to the winner problem for Kemeny elections [181 Lemma 
4.2] works as follows. There is a polynomial-time computable function g such that for all irreflexive and 
antisymmetric digraphs G, g(G) is an election whose candidates are the vertices of G and such that for all 
vertices c of G, (G, c) is in Feedback Arc Set Member if and only if c is a Kemeny winner of election g(G). 
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Theorem 2.4 For each of Dodgson elections, Kemeny elections, and Young elections, the 
following control problems are O^-hard: constructive control by adding candidates, construc- 
tive control by deleting candidates, constructive control by adding voters, and constructive 
control by deleting voters. 

An anonymous referee commented that even polynomial-time algorithms can be expen- 
sive to run on sufficiently large inputs. We mention that though the comment is correct, 
almost any would-be controller would probably much prefer that challenge, solving a P 
problem on large inputs, to the challenge our results give him/her, namely, solving an NP- 
complete problem on large inputs. We also mention that since the hybrid scheme is designed 
so as to inherit resistances from the underlying schemes, if a hybrid requires extreme ratios 
between the number of candidates and the number of voters to display asymptotic hardness, 
that is purely due to inheriting that from the underlying systems. Indeed, if anything the 
hybrid is less likely to show that behavior since, informally put, if even one of the underlying 
systems achieves asymptotic hardness even away from extreme ratios between the number 
of candidates and the number of voters, then their hybrid will also. 

2.5 Inheritance 

We will be centrally concerned with the extent to which hybrid(So,£\, . . . ,£k-i) inherits 
the properties of its constituents. To do so, we formally define our notions of inheritance 

We turn this into a reduction from the complement of Feedback Arc Set Member to the unique winner 
problem for Kemeny elections as follows: Given an input instance (G, c) of Feedback Arc Set Member, add 
a new vertex d to G and add arcs from d to every vertex in V(G) — {c}. Note that no minimum-size 
feedback arc set of G contains an arc starting from d (since these arcs are not part of a cycle), and so for all 
c' £ V(G) — {c}, (G, c') is not in Feedback Arc Set Member. Also note that (G,d) is trivially in Feedback 
Arc Set Member since there are no arcs entering d. 

Now consider election g(G). Recall that the candidates of g(G) are the vertices of G and that for all 
vertices c' in G, (G, c') is in Feedback Arc Set Member if and only if c' is a Kemeny winner of election g(G). 
From the observations above, it follows immediately that (G, c) is in Feedback Arc Set Member if and only 
if d is not the unique Kemeny winner of election g(G). Since (G, c) is in Feedback Arc Set Member if and 
only if (G, c) is in Feedback Arc Set Member, we have obtained a polynomial-time reduction from Feedback 
Arc Set Member to the complement of the unique winner problem for Kemeny elections. Since Of i s closed 
under complement, this proves that the unique winner problem for Kemeny elections is Of-hard. 

Of -completeness of the winner problem for Young elections was shown in |17j . The Of upper bound is 
easy to show, and the same argument can be used to show a Of upper bound for the unique winner problem. 
Of -hardness of the winner problem for Young elections was shown as Theorem 2.5 in |17] via a reduction 
from the Of-complete problem Maximum Set Packing Compare (MSPC, for short) 17 : Given two sets, B\ 
and £>2, and two collections of sets, S\ and S2, where each S € Si is a nonempty, finite subset of Bi, is it 
the case that k(Si) > ^(£2)? Here, n(Si) denotes the maximum number of pairwise disjoint sets in Si. 

The proofs of Theorems 2.3 and 2.5 in [17] show how to construct from a given MSPC instance / = 
(Si, B2, Si, 1S2) an election (G, V) with two designated candidates, c and d, such that (a) if k(<Si) > «;(<5>2) 
then c and d are Young winners of (G, V), and (b) if k(S2) > k(Si) then d is the unique Young winner 
of (G, V). It follows that / is in MSPC if and only if d is not the unique Young winner of (G, V). Thus 
the complement of the unique winner problem for Young elections is Of-hard. Since Of is closed under 
complement, this proves that the unique winner problem for Young elections is Of -hard. □ 
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(if all the constituents have a property then so does their hybrid) and of strong inheritance 
(if even one of the constituents has a property then so does the hybrid). 

Definition 2.5 We say that a property T is strongly inherited (respectively, inherited,) by 
hybrid if the following holds: Let k £ N + . Let So, Ei, . . . , £k-i be candidate- anonymous elec- 
tion systems (each taking as input (C, V), with V a list of preference orders). It holds that 
hybrid(£o,£\, . . . ,£k-i) has property T if at least one of its constituents has (respectively, 
all its constituents have) property T. 

Definition 12.51 builds in the assumption that all constituents are candidate-anonymous. 
This assumption isn't overly onerous since as mentioned earlier candidate-anonymity is 
very common — but will be used in many of our proofs. In effect, it is the price we pay for 
our choice of "switching between systems" rule within hybrid. One might naturally worry 
that as hybrid is not itself candidate-anonymous, inheritance results might be difficult to 
prove for a hybrid of hybrids. That is true, but before reaching such an impasse one would 
typically avoid it, namely, instead of trying to study 

hybridihybridiE-o^x, . . .,£k-i), hybrid^, £[, . . . ,£' k >-i)) 

rather studying hybrid(£o, £\, . . . , £k-i, £'$-, £[, • • • , £'k'-i)- Though there of course are issues 
regarding default handling, in most settings this will not have problems, and in fact we will 
do precisely this later (in the proof of Theorem I3.11|) . 

Though we will build candidate-anonymity into the assumptions underlying inheritance, 
we will often try to let interested readers know when that assumption is not needed. In 
particular, when we say "inherited (and flexibly so)" or "strongly inherited (and flexibly 
so)," the "(and flexibly so)" indicates that the claim holds even if in Definition 12 . 51 the words 
"candidate-anonymous" are deleted. For example, the following easy but quite important 
claim follows easily from the definition of hybrid. 

Proposition 2.6 "Winner problem membership in P" and "unique winner problem mem- 
bership in P" are inherited (and flexibly so) by hybrid. 

That is, if £q, £±, . . . , £k-i are election rules (all, as we assume globally, based on input 
preference orders) for which testing whether a given candidate is the winner is in P (i.e., 
{(C, V, c) | c is a winner in the election specified by (C, V)} £ P), then the winner problem 
for hybrid(£o,£i, . . . ,£k-i) is also in P. We similarly have that the following claim follows 
easily from the definition of hybrid. 

Proposition 2.7 "Winner problem membership inNP" and "unique winner problem mem- 
bership in NP" are inherited (and flexibly so) by hybrid. 

(In fact, it is easy to see that when the constituent systems are candidate- anonymous then, 
for each k > 0, it holds that the winner problem (respectively, unique winner problem) 
of hybrid is in TP k if and only if all the constituent winner problems (respectively, unique 
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winner problems) are in £?, where as is standard denotes the kth level of the polynomial 
hierarchy.) 

On the other hand, sometimes we will want to focus just on elections having a certain 
property <£, and for those we use the following definition. 

Definition 2.8 We say that a property T is strongly inherited (respectively, inherited,) by 
hybrid on election systems having property <J> if the following holds: Let k E N + . Let 
£o,£i, ■ ■ ■ ,£k-i be candidate- anonymous election systems (each taking as input (C, V), with 
V a list of preference orders) each having property $. It holds that hybrid(£o,£i, . . . ,£k-i) 
has property T if at least one of its constituents has ( respectively, all its constituents have ) 
property V. 

2.6 Discussion of Some Concrete Objections 

It is important when presenting an election system to make clear what the purpose of 
defining it is and how it is intended to be used. This was already discussed in part in 
Sections [T] and 12.21 However, we now have defined for the reader our hybridization scheme 
and key notions such as control and inheritance, and so we are in a better position to be 
able to address potential worries. So, as a way both of recapping some of the points of 
Sections [Tl and 12^21 and of making some additional important points about the nature of our 
hybridization system, we will now state and discuss some interesting issues that one might 
wonder about. 

One natural issue is that our model is about worst-case hardness and so may not speak 
to typical (frequent) hardness. One anonymous referee observed that since the vast majority 
of the inputs will have mismatches in the moduli of the names (i.e., will have mismatches 
in what the input names are congruent to modulo k) and so will map to the default system, 
the election systems other than the default one "do not really matter." 

This actually raises a number of issues. We will try to now address them briefly but 
clearly. 

First, and most importantly, the core purpose of the hybrid scheme is not to be a system 
that is used directly as a practical, real-world election system, but rather is, as discussed in 
the introduction, to show that the impossibility result: 

"For no election system whose winner complexity is in P are all twenty types of 
control NP-hard." 

outright does not hold. And by showing that we can combine control resistances while 
not boosting the complexity of the winner problem beyond P, our hybrid scheme in fact 
breaks all hope of such an impossibility result, via showing that there is an election system 
whose winner complexity is in P yet for which all twenty types of control are NP-hard 
(Theorem 13. lip . 

Second, the hybrid scheme's point is to in effect "join" its underlying systems. It provides 
a one-stop system that allows one (by appropriately renaming the candidates) to get the 
effect of any one of the underlying systems (assuming candidate-anonymity holds for those). 
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As to the referee's comment that the vast majority of the inputs will have mismatches in 
the moduli of the names and so will map to the default system, and so the election systems 
other than the default one "do not really matter," the comment works best if one views the 
entire hybrid as a stand-alone system intended for direct, natural use, and if one further 
feels that such use should be with respect to a uniform distribution of inputs directly to 
hybrid. But as argued in the previous paragraph, the hybrid scheme is not intended as 
a system for direct, natural, real-world use; it is built to give insight into inheritance of 
control resistance and most critically into (non)existence of impossibility results. Further, 
even if one did want to look at the system relative to a uniform notion of inputs, given that 
the system (as mentioned at the start of the present paragraph) is intended to combine k 
systems, the natural notion of a uniform input draw would be to randomly choose one of the 
k systems, randomly generate an instance there, and then mod-encode the names to place 
that instance into the hybrid scheme. Note that in this approach/distribution, the frequency 
of having inputs route to the default system due to name moduli mismatches would not be 
very frequent but would be "absolutely never." (As a very loose and admittedly imperfect 
analogue, if one types random keystrokes, one is very unlikely to get a Boolean formula that 
is syntactically well-formed. And so relative to an utterly uniform distribution of that sort, 
SAT becomes trivial in the vast majority of cases. For us, agreement of name moduli is a 
form of syntactic filter used to discipline the input, and inputs lacking agreement are swept 
to the default system.) 
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Third, let us make clear that there is a very real, important issue in the concrete objec- 
tion being discussed. Namely, what about frequency of hardness, or even about average-case 
hardness? Clearly, the hypothetical impossibility theorem above itself includes the notion of 
NP-completeness, which is a worst-case theory, rather than one focused on either average- 
case NP-hardness or frequency of hardness. It is indeed very natural to hope to achieve 
average-case NP-hardness or frequency of hardness results. We fully agree that this is a 
very interesting, important long-term issue. But we briefly mention some cautions and limi- 
tations. Regarding average-case NP-hardness, a well-known theory developed by Levin [47] . 
the theory is lovely, but only a handful of problems have been shown to be average-case 
NP-hard, and not a single one of those in any way involves elections. Regarding frequency 
of hardness, there have been a number of recent results showing that certain NP-hard elec- 
tion issues can be frequently simple, but to the best of our knowledge, none of those papers 
obtains such results for any control problem^ Briefly summarized, issues of average-case 
NP-hardness and of frequency of correctness are clearly very interesting, are rightly gaining 
attention, and we highly commend them to the reader while also mentioning that the field's 
understanding of such results and ability to obtain them is still very limited and currently 
doesn't exist at all for the case of control problems (except see the comment of the next 
paragraph, which in a sense says that our work at least preserves good behavior in this 
regard) . 

Still continuing on this third point, however, namely of frequency of hardness, in the par- 
ticular case of the present paper's work we do have a case where — in a certain rigorous sense 
that is theoretically crisp although practically quite unsatisfying — inheritance of hardness 
does hold. In particularly, it is clear, directly from our definitions, that hardness inherits 
under our scheme — indeed, that hardness strongly inherits under our scheme. In particu- 
lar, if even just one of the constituent systems (all required to be candidate anonymous) is 

12 All such work that we know of regards winner and manipulation problems, not control problems, and 
even for the winner and control cases such results typically require one to choose the distribution very 
carefully. For example, the work of [48149] and [50] succeeds in the uniform distribution, but is not known to 
hold under other distributions, and anyway is about winner problems and not about control or manipulation. 
And in the interesting work of [51] . which is about manipulation (not about control), the frequency of being 
able to manipulate is conditioned inside the set of cases that are manipulable at all. For the one concrete 
distribution family on which that paper does experiments, it is easy to see that except for the special 
case of the uniform distribution, "p — 0.5" in their notation, asymptotically the portion of cases that are 
manipulable is extraordinarily small (because whomever is at the top of what they call the "correct" ranking 
will as the number of voters grows, win by a large amount when p 0.5). So what one should take away is 
not that the election systems are almost always easily manipulable, but rather that the election system they 
studied are, for that distribution, almost never manipulable (but nonetheless that, and this is that paper's 
remarkable insight, conditioning within the extraordinarily low probability- weight of instances in which they 
are manipulable, one can with high probability easily find a manipulation, again with this all framed within 
that distribution) . Without trying to here list all the other interesting papers addressing issues of frequency 
of correctness, as there are many and all of them are not about the present paper's focus (namely, control), we 
mention as particularly interesting (and provocative) the work of Procaccia and Rosenschein on juntas and 
manipulation [52] . the Procaccia and Rosenschein fraction-of- manipulators work [53], the work of Friedgut, 
Kalai, and Nisan on random manipulations [52], and the Zuckerman, Procaccia, and Rosenschein work on 
coalition manipulation |55| . 
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exponentially often exponentially hard, then so is the hybridization of those systems. The 
catch here is that it is a "small" exponential regarding the frequency of hardness, namely 
2 Q ("), and so it ensures an exponentially rich core of hard instances, but it still could be 
the case that the overwhelming majority of instances are easy@ 

However, we should not allow ourselves to be overly sidetracked. The main points here 
are simply that our hybrid system is primarily designed to show that control can be strongly 
inherited, and it does so and thus completely rules out the natural, potential impossibility 
result. And that issues of frequency of hardness are indeed interesting, although difficult 
and typically very distribution-based, and deserve (and are getting) further investigation. 
Regarding the first of these points, one might ask whether one really needs an artificial 
system to preclude the impossibility result. The authors and P. Faliszewski have, motivated 
by the present paper, looked hard at this issue. As mentioned earlier, they have very recently 
shown (in [32] give or take one's view on a technical fine point, and in [27J regardless of 
one's view on the technical fine point) that there is a natural system — one of the versions of 
Copeland voting — that has a P winner problem yet is immune to all ten types of constructive 
control. However, that system is vulnerable to most types of destructive control. And 
so their work gives an alternate path to precluding a ten-constructive-case impossibility 
result, but unlike the present paper does not preclude the main goal — a twenty-case overall 
impossibility result — or even preclude a ten-destructive-case impossibility result. 

This completes our discussion regarding whether systems other than the default really 
matter in hybrid, and of issues of average-case NP-hardness and frequency of hardness. We 
now turn to a second concrete worry one might have. 

One anonymous referee proposed a different hybrid scheme than ours based on, on each 
input, randomly choosing a system to route the question to. Unfortunately, that approach 
to a hybrid scheme is not a valid election rule, as it uses probability not just to compute 

13 For completeness, let us be specific as to what is being claimed. Let us say a problem A is exponentially 
often exponentially hard if there is an e > such that, for each Turing machine M accepting A, there are 
an infinite number of lengths n at which M runs for at least 2 En steps on at least 2 En of the strings of that 
length. Our theorem is this: Being exponentially often exponentially hard is strongly inherited (in the sense 
of Definition I2.5|l by hybrid. This is true simply because the process of taking an instance from one of 
the constituent elections and recoding the names in the natural way to recast the instance into our hybrid 
scheme increases the instance's length at most linearly. 

Our framing of this claim just said "there are an infinite number of lengths" at which the hardness holds, 
but note that, again due to the fact that we can achieve at-most-linear instance-length-stretching, whatever 
the original density of hard lengths is of the hard constituent system, the density of hard lengths in hybrid 
will be no more than linearly less. Informally put, we don't lose too much density of hard lengths. 

We mention in passing that the above claim remains true if each 2 n( - n ' above is changed to 2™ 1 ' , a dif- 
ferent, even smaller notion of having exponentially many elements. Although 2 n ' n - ) and 2™ ( ' are not prac- 
tically very satisfyingly large when compared (regarding frequency) with 2" , we mention that in theoretical 
computer science this type of density is very natural and typical in such settings. This is due to the fact 
that for each e > 0, every NP-hard set A is, by standard padding arguments, known to be polynomial-time 
many-one equivalent to sets (e.g., {o' 1 ' #x | x £ A}, where k is chosen to satisfy k > 1/e) that for each n 
are trivial on all but 2" of their length n strings. Indeed, for almost precisely this reason, Levin's theory 
of average-case NP-hardness [37] allows some sets that are trivial on all but at most 2™ of their length n 
strings to be average-case NP-hard. 
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something, but also its output itself is probabilistic. That is, if one were to repeatedly run 
the exact same set of completed ballots through that "rule," one would get different winners 
on different such runs. That isn't an election rule in the standard sense universally used to 
study control, and the reduction framework (that we ourselves exploit to prove hardness) 
does not apply to this. In addition, the present paper proves results for its system. 

We now turn to a third concrete worry. Our paper's key tool is a hybrid scheme. We 
then apply it using certain building blocks (constituent election systems to be hybridized 
together). Let us say a voting system is voiced (see [21]) if (whenever there is at least one 
candidate) there will be at least one winner. Although nonvoiced systems have been allowed 
in the study of control in every paper we know of on control, one might dislike the fact that 
in some places in this paper we use building blocks that are not voiced (may sometimes have 
no winner). The two building blocks we use that are not voiced are Condorcet elections 
and an artificial election system we call £ n ot-aii-one- However, we point out that one can just 
as easily toss out those two building blocks and use instead any other existing system(s) 
that have the resistance properties that the discarded blocks were being used for and that 
in addition are voiced. Such systems have been proven (although just recently) to exist. 
Combined with the easy-to-see claim that voiced-ness inherits under our hybrid scheme, 
one can, if one dislikes nonvoiced systems, establish the theorems in question via a voiced 
hybrid of voiced systems 

3 Inheritance and Hybrid Elections: Susceptibility, Resis- 
tance, Immunity, and Vulnerability 

In this section we will discuss the inheritance properties of hybrid with respect to suscepti- 
bility, resistance, immunity, and vulnerability. Tables [I] and [2] summarize our results for the 
cases of, respectively, constructive control and destructive control. (These tables do not dis- 
cuss/include the issue of when "(and flexibly so)" holds, i.e., when the candidate-anonymity 
assumption is not needed, but rather focus on our basic inheritance definition.) 

3.1 Susceptibility 

We first note that susceptibility strongly inherits. In fact, we prove something slightly 
stronger, as for only the susceptible constituent do we need to assume candidate-anonymity 
(also, as noted in the introduction, candidate-affine-invariance would actually suffice). We 
remind the reader that throughout this paper, when we speak of an election system, we 
always implicitly mean an election system that takes as input (C, V) (see Footnote [3]) with 
V a list of preference orders over C. 

14 To be utterly concrete about this, Condorcet voting is used in this paper for its resistance to constructive 
control by adding, deleting and partitioning of voters, and £ no t-all-one i s use< A in this paper for its resistance 
to destructive control by adding, deleting and partitioning of voters (in the TE model). However, very recent 
work [32] has proven that the natural, voiced election system of Llull (and also the natural, voiced election 
system of Copeland and many variants [32127] ) itself has all of these resistance properties, and so one can, 
if one requires voiced systems, employ Llull elections here in place of both Condorcet and £ no t-all-one- 
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Control by 


Susceptibility 


Resistance 


Immunity 


Vulnerability 


Adding Candidates 


SI 


SI 


Not I 


I 




I3~2l 


1531 


13.181 


13.191 


Deleting Candidates 


SI 
1531 


SI 

EH 


I 

13.141 


I if and only if P = NP 
13.241 


Partition 


SI 


SI 


Not I 


On election systems having 


of Candidates (TE) 


E3 


EH 


13.181 


unique winner problems in PH: 
I iff SI iff P = NP 
13.341 


Partition 


SI 


SI 


Not I 


On election systems having 


of Candidates (TP) 








winner problems in PH: 
I iff SI iff P = NP 




1531 


EH 


13.181 


13.341 


Run-off Partition 


SI 


SI 


Not I 


On election systems having 


of Candidates (TE) 








unique winner problems in PH: 
I iff SI iff P = NP 




1531 


EH 


13.181 


13.301 


Run-off Partition 


SI 


SI 


Not I 


On election systems having 


of Candidates (TP) 








winner problems in PH: 
I iff SI iff P = NP 




1531 


EH 


13.181 


13.301 


Adding Voters 


SI 
1531 


SI 

EH 


I 

13.171 


I 

13.201 


Deleting Voters 


SI 
1531 


SI 

EH 


I 

13.171 


I 

13.201 


Partition 


SI 


SI 


I 


I 


of Voters (TE) 


1531 


EH 


13.171 


13.201 


Partition 


SI 


SI 


I 


I 


of Voters (TP) 


E3 


EH 


13.171 


13.201 



Table 1: Inheritance results that hold or provably fail for hybrid with respect to constructive 
control. Key: I = Inherits. SI = Strongly Inherits. The numbers in each box give results 
establishing or implying that box's claim. Those table entries in the vulnerability column 
containing "on election systems" clauses are somewhat informally stated above; see the 
cited results for precise statements. 
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Control by 
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SI 
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Deleting Candidates 


SI 
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I if and only if P = NP 
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SI 
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On election systems having 


of Candidates (TE) 
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EH 


13.181 


unique winner problems in PH: 
I iff SI iff P = NP 
13.391 
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Not I 


On election systems having 


of Candidates (TP) 








winner problems in PH: 
I iff SI iff P = NP 
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EH 
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13.391 


Run-off Partition 


SI 


SI 


Not I 


On election systems having 


of Candidates (TE) 








unique winner problems in PH: 
I iff SI iff P = NP 




1531 


EH 


13.181 


13.391 


Run-off Partition 


SI 


SI 


Not I 


On election systems having 


of Candidates (TP) 








winner problems in PH: 
I iff SI iff P = NP 




1531 


EH 


13.181 


13.391 


Adding Voters 


SI 
1531 


SI 

EH 


I 

13.171 


I 

13.201 


Deleting Voters 


SI 
1531 


SI 

EH 


I 

13.171 


I 

13.201 


Partition 


SI 


SI 


I 


I 


of Voters (TE) 


1531 


EH 


13.171 


13.201 


Partition 


SI 


SI 


I 


I 


of Voters (TP) 


E3 


EH 


13.171 


13.201 



Table 2: Inheritance results that hold or provably fail for hybrid with respect to destructive 
control. Key: I = Inherits. SI = Strongly Inherits. The numbers in each box give results 
establishing or implying that box's claim. Those table entries in the vulnerability column 
containing "on election systems" clauses are somewhat informally stated above; see the 
cited results for precise statements. 
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Theorem 3.1 Let k € N + and let So, £\, . . . , £k-i be election systems. Let <3? be one of 
the standard twenty types of (constructive and destructive) control. If for at least one i, 
< i < k — 1, £i is candidate- anonymous and susceptible to <3?, then hybrid(£o,£%, . . . ,£k— 1) 
is susceptible to <1>. 

Proof. Take an example showing that £ \ is susceptible to $ and rename each candidate 
c in it to now be named he + i. This transformed example will, due to £^s candidate- 
anonymity, be an example showing hybrid(£o,£i, . . . ,£fc_i)'s susceptibility to <1>. □ 

We note in passing that there is nothing particularly limiting the above theorem to the 
standard twenty types of control. The embedding would work equally well on almost any 
natural control type one might imagine. 

Theorem 13.11 immediately yields the following corollary. 

Corollary 3.2 hybrid strongly inherits susceptibility to each of the standard twenty types 
of control. 

3.2 Resistance 

We now come to the most important inheritance case, namely, that of resistance. Since our 
hope is that hybrid elections will broaden resistance, the ideal case would be to show that 
resistance is strongly inherited. And we will indeed show that, and from it will conclude 
that there exist election systems that are resistant to all twenty standard types of control. 

We first prove the key result, which uses the fact that hybrid can embed its constituents 
to allow us to <m-reduce from control problems about its constituents to control problems 
about hybrid. 

Theorem 3.3 Let k € N + and let £®, £\, . . . , 1 be election systems. Let be one of 
the standard twenty types of (constructive and destructive) control. If for at least one i, 
< i < k — 1, £jis candidate- anonymous and resistant to <3? ; then hybrid(£o, £i, . . . ,£k-i) 
is resistant to <1>I 15 I 




Proof. Let $ and i and £q, £i, . . . , i satisfy the conditions of the theorem. By 
Theorem l3.lt hybrid(£o, £i, ■ ■ ■ ,£k-i) is susceptible to $, since f^'s resistance ensures that 
£i is susceptible. And since £i is resistant to the control problem for £{ is NP-hard. 
Now, note that the control problem for £i with respect to $ itself many-one polynomial- 
time reduces to the control problem for hybrid(£o,£i, . . . ,£k-i) with respect to via the 

15 A referee presented a "counterexample" that, though incorrect, is worth refuting so that no other reader 
need have the same worry. Briefly put, the referee noticed that if So and £i are candidate-anonymous election 
systems such that So is resistant to control type "!> and Si is not, then hybrid(So,S\) will be routed to Si 
unless all candidate names are even, and then said that since it will not always be the case that all candidate 
names are even, this showed that the hybrid was not resistant. The error in this reasoning is the incorrect 
implicit claim that NP-hard problems cannot have subcases — sometimes even quite broad ones — in P. They 
in fact can, e.g., 2CNF-SAT is in P. 




24 



reduction that replaces each candidate name c with the name kc+i. So the control problem 
for hybrid(£o, £ 1; . . . , £k~i) with respect to $ is itself NP-hard. □ 



We note in passing that there is nothing particularly limiting the above theorem to the 
standard twenty types of control. The proof's many-one reduction would work equally well 
on almost any natural control type one might imagine. 

Theorem 13.31 immediately yields the following corollary. 

Corollary 3.4 hybrid strongly inherits resistance to each of the standard twenty types of 
control. 

Before we turn to applying this corollary, let us note that Theorem 13.31 and Corollary [331 
are both, as is this entire paper, within the most natural, most typical model: Votes are 
input as a list ( "nonsuccinct" input) and each vote counts equally ("unweighted" votes). 
We mention that for each of the other three cases — "succinct, weighted," "succinct, un- 
weighted," and "nonsuccinct, weighted" — Theorem 13.31 and Corollary 13.41 both still hold 
(by the same proofs as above). 

Let us apply Corollary 13.41 to obtain election systems that are broadly resistant to 
control. (We mention that since this paper first appeared, [27] (see also [32]) has created a 
very attractive alternate way of seeing that systems exist that resist the ten standard types 
of constructive control, namely, by proving that Copeland's election system resists the ten 
standard constructive control types. Unfortunately, the just-cited papers also show that 
Copeland elections do not resist some of the ten standard destructive control types.) 

Corollary 3.5 There exist election systems — for example, hybrid(plursdity, Condorcet) — 
that are resistant to all the standard ten types of constructive control. 

Proof. By the work of Bartholdi, Tovey, and Trick ([2], see also [21] regarding the tie- 
handling rules), for each of the standard ten types of constructive control, at least one of 
plurality and Condorcet is resistant. So by Corollary 13.41 and the candidate-anonymity of 
plurality and Condorcet, we are done. □ 

To make the same claim for destructive control, we first construct an (artificial) system, 
£not-aii-one (we define this system shortly), having the missing three resistance properties. 
(As mentioned earlier, an alternate approach would be to rely on work done after this paper, 
stating that the system "Copeland 0,5 " has these three resistances [27J, and then to use that 
system as a component and hybridize using it.) 

Lemma 3.6 There exists a candidate- anonymous election system, £ n ot-aii-one > that is resis- 
tant to 

1. destructive control by deleting voters, 

2. destructive control by adding voters, and 
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3. destructive control by partition of voters in the TE model. 

Proof. Our proof constructs reductions from Exact Cover by Three-Sets (X3C, for short), 
which is one of the standard NP-complete problems (see Garey and Johnson [56]) and is 
defined as follows: 

Exact Cover by Three-Sets (X3C) 

Given: A set B, and a family S = {Si, S2, ■ ■ ■ , S n } of subsets Si of B with \\Si\\ = 3 for 
each i. 

Question: Does S have an exact cover for B? That is, is there a subfamily S' C S such 
that every element of B occurs in exactly one set in 5'? 

The system £ n ot-aii-one works as follows: The first four candidates in each vote get one 
point each. A candidate c is a winner if and only if c is the most preferred candidate of a 
strict majority of the voters and it is not the case that all candidates other than c have one 
point. Note that if c is a winner, then c is the unique winner. It is immediate that £ n ot-aii-one 
is candidate-anonymous and it is easy to see that £ n ot-aii-one is susceptible to destructive 
control by deleting voters, adding voters, and partition of voters in the TE model. 

NP-hardness of the destructive control problem follows in all three cases from a re- 
duction from the problem X3C. Let (B,S) be an instance of X3C with ||i?|| = to, 
S = {Si, S2, ■ ■ ■ , S n }, Si C B, and = 3 for each i. Without loss of generality, we 
assume that to is divisible by 3 and to/3 > 1. Construct an instance of Destructive Control 
by Deleting Voters as follows. The candidate set is defined as C = B U {d}, where d is the 
distinguished candidate. The set V of voters consists of n preference orders corresponding 
to the sets in S: For each i, V contains voter d > Si > ■ ■ ■ , where "SV' denotes the elements 
of Si in some arbitrary order, and "• • • " means that the remaining candidates follow in some 
arbitrary order. 

Claim 3.7 (B, S) is in X3C if and only if there is a set V C V such that || V'|| < n — to/3 
and d is not the unique winner of (C,V — V). 

Proof of Claim [3.71 Suppose that (B,S) is in X3C. Let V" consist of m/3 voters from 
V that correspond to an exact cover and let V = V — V" . Then ||V'|| = n — to/ 3 and each 
candidate c £ C , c ^ d, scores one point in V" = V — V . So, d is not the unique winner of 
(C,V-V). 

For the converse, let V C V be such that ||V'|| < n — m/3 and d is not the unique winner 
of (C, V — V). Since d is the most preferred candidate for every voter in V and V — V is 
not empty (since to/3 > 1), it follows that all other candidates score one point in V — V . 
This implies that the voters in V — V correspond to an exact cover of S. □ Claim 13.71 

Claim 13.71 establishes Case [1] of Lemma 13.61 
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We will use a similar construction to reduce X3C to Destructive Control by Adding 
Voters. The candidate set is now denned as C = B U {d, ci, C2, C3}. The set V of registered 
voters consists of one voter d > c% > C2 > C3 > • • • and the set W of unregistered voters 
consists of n preference orders corresponding to the sets in iS: For each i, W contains voter 
d > Si > • • • , where denotes the elements of Si in some arbitrary order, and "• • • " 
means that the remaining candidates follow in some arbitrary order. 

Claim 3.8 (B,S) is in X3C if and only if there is a set W' C W such that \\W'\\ < m/3 
and d is not the unique winner of (C, V U W). 

Proof of Claim [3.81 Suppose that (B,S) is in X3C. Let W consist of m/3 voters from 
W that correspond to an exact cover. Then each candidate c E C, c 7^ d, scores one point 
in V U W . So, d is not the unique winner of (C, V U W). 

For the converse, let W' C W be such that ||W'|| < m/3 and d is not the unique winner 
of (C, V U W). Since d is the most preferred candidate for every voter in VUW' and VL)W 
is not empty, it follows that all other candidates score one point in V U W'. This implies 
that the voters in W' correspond to an exact cover of S. □ Claim [3781 

Claim 13.81 establishes Case [2] of Lemma 13.61 

We will use a similar construction to reduce X3C to Destructive Control by Partition of 
Voters in the TE model. As in the previous case, the candidate set is defined as C = B U 
{d, c\ , C2, C3}. The set V of voters consists of one voter of the form d > c\ > C2 > C3 > • • • , n 
voters of the form c\ > • • • , and n preference orders corresponding to the sets in S: For each 
i, V contains voter d > S{ > ■ ■ ■ , where "SV' denotes the elements of Si in some arbitrary 
order, and "• • • " means that the remaining candidates follow in some arbitrary order. 

Claim 3.9 (B,S) is in X3C if and only if d can be made to be not the unique winner of 
this election by partition of voters in the TE modelf^ 

Proof of Claim 13.91 Suppose that (B,S) is in X3C. Let the first subelection consist of 
voter d > c\ > C2 > C3 > ■ ■ ■ and m/3 voters of the form d > Si > • ■ ■ that correspond to 
an exact cover. Then d does not win the first subelection. d also does not win the second 
subelection, since most voters in the second subelection prefer c\. Since d wins neither 
subelection, d is not an overall winner of the election. 

For the converse, suppose that d is not the unique winner of the election. Since d is 
the unique winner of every subelection that involves d and at most one other candidate, 
it follows that d is the unique winner of the final run-off if d participates in the final run- 
off. Since d is not the unique winner of the election, d cannot participate in the final 
run-off, and should thus lose both subelections. In at least one of the subelections, d is 
the most preferred candidate for a strict majority of the voters. Since d does not win this 

16 In fact, the tie-handling rule is irrelevant here, since there is always at most one winner in an £ no t-all-one 
election. However, we state the claim for the TE model because that is what we need for Lemma 13.61 
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subelection, the voters in this subelection of the form d > Si > ■ ■ ■ correspond to an exact 
cover. □ Claim 13.91 



Claim [3791 establishes Casel3lof Lemma 13.61 □ Lemma [3761 

Corollary 3.10 There exist election systems that are resistant to all ten standard types of 
destructive control. 

Proof. By Lemma 13.61 and the work of Hemaspaandra, Hemaspaandra, and Rothe [21] , 
for each of the standard ten types of destructive control, at least one of plurality and 
£not-all-one is resistant. So by Corollary 13.41 and the candidate-anonymity of plurality and 
£ not-all-one, we are done. □ 

We cannot apply Theorem 13.31 directly to rehybridize the systems of Corollaries 13.51 
and 13.101 because hybrid itself is not in general candidate-anonymous. However, we can get 
the same conclusion by directly hybridizing all the constituents underlying Corollaries 13.51 
andETini 

Theorem 3.11 There exist election systems that are resistant to all twenty standard types 
of control. 

The proof simply is to consider /iyhrid(plurality, Condorcet, £ n ot-all-one)- 
3.3 Immunity 

We now turn to inheritance of immunity. Here, for each of constructive and destructive 
control, five cases inherit and five cases provably fail to inherit. 

However, let is first pause a moment to define the artificial, candidate-anonymous elec- 
tion system £ nu u, in which all candidates always lose. Note that £ QU \\ is immune to all 
twenty standard types of control — trivially, since no one ever wins. This type of result 
shows why it is natural to focus, as this paper does, on achieving broad resistance rather 
than on achieving broad immunity: Resistance is less trivializable than immunity. In fact, 
we will now turn to showing that immunity to constructive control by deleting candidates is 
inherited by hybrid (Theorem 13. 14)) . and our proof of that will be based on a trivialization 
of immunity. In that proof, we will employ the following somewhat interesting triviality 
result. 

Theorem 3.12 Any candidate- anonymous election system that is immune to constructive 
control by deleting candidates can never have a unique winner. 

Proof. Let £ be any candidate-anonymous election system that is immune to constructive 
control by deleting candidates. Suppose there is an election (C, V) in which some candidate, 
say c € C, is the unique winner, and let V consist of the voters v±, V2, ■ ■ ■ , Vk- By candidate- 
anonymity of £ , there is a candidate set D with D n C = that simply renames all 



28 



candidates in C, and a voter set W consisting of voters wi, W2, ■ ■ ■ , iffc that simply renames 
all candidates occurring in V from their C names to their D names such that d € D is the 
unique winner of (D, W). Now, consider the election with candidate set C U D and voter 
set X consisting of the k preference orders 

Vi,i > v i<2 > ■■■> fi,|jc|| > w it i > w it 2 > ■ ■ > Wi,\\D\\, 
where 1 < i < k and the ith voter in, respectively, V and W has preference order V{ = 

Vi,l > V i>2 >•"> Vi,\\C\\ an d w i = w i,l > w i,2 > ■ ■ > ^i,||D||- 

If c is not a unique winner of the election (C U D, X), then £ is not immune to con- 
structive control by deleting candidates, as by deleting D, c becomes the unique winner. 
Similarly, if d is not a unique winner of the election (C U D,X), then £ is not immune to 
constructive control by deleting candidates, as by deleting C, d becomes the unique win- 
ner. However, since £ is immune to constructive control by deleting candidates and since 
(C U D,X) cannot have both c and d be unique winners, our supposition that £ can have 
a unique winner is contradicted. □ 

The following lemma follows immediately from the definition of hybrid. 

Lemma 3.13 "Never having a unique winner" is inherited by hybrid. 

We now can prove our claim. 

Theorem 3.14 Immunity to constructive control by deleting candidates is inherited by 
hybrid. 

Proof. If £q, £1, . . . , £k-i are candidate-anonymous election systems that are immune to 
constructive control by deleting candidates, then by Theorem 13. 121 each never has a unique 
winner. So by Lemma f3. 131 hybrid(£o, £\, . . . , £k-i) never has a unique winner. This proves 
that hybrid(£o,£i, . . . , £k-i) is immune to every type of control. □ 

By applying a duality result of Hemaspaandra, Hemaspaandra, and Rothe k times, we 
can retarget this to a type of destructive control. 

Proposition 3.15 ([21]) 

1. A voting system is susceptible to constructive control by adding candidates if and only 
if it is susceptible to destructive control by deleting candidates. 

2. A voting system is susceptible to constructive control by deleting candidates if and 
only if it is susceptible to destructive control by adding candidates. 

Corollary 3.16 Immunity to destructive control by adding candidates is inherited by 
hybrid. 
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Proof. The proof follows immediately from Theorem 13.141 plus 1 + (k — 1) applications 
of Proposition EEEJ □ 



hybrid's immunity to all voter-related types of control is immediate. 
Theorem 3.17 Immunity to constructive and destructive control under each of these: 

1. adding voters, 

2. deleting voters, 

3. partition of voters in model TE, and 
4- partition of voters in model TP 

is inherited (and flexibly so) by hybrid. 

Proof. Since none of this theorem's four operations changes the candidate set, hybrid 
routes all election evaluations related to a given input to the same election system fj, and 
so by that system's immunity the theorem holds. □ 

For the ten remaining cases, inheritance does not hold. 

Theorem 3.18 hybrid does not inherit immunity to: 

1. constructive control by adding candidates, 

2. destructive control by deleting candidates, 

3. constructive control by partition and run- off partition of candidates (both in model TE 
and TP), and 

4- destructive control by partition and run- off partition of candidates (both in model TE 
and TP). 

Proof. For each of these ten control problems, we provide a counterexample showing 
that immunity is not inherited by hybrid. We will use the artificial, candidate-anonymous 
election systems £fi rs t and £i as t> which are defined as follows. A candidate c wins an £a TS t 
election if and only if there is one voter and this voter ranks c first. A candidate c wins an 
£i as t election if and only if there is one voter and this voter ranks c last. It is immediate 
that ffi rs t and £i ast are candidate-anonymous. 

1 . It is immediate that £fi rs t and £i as t are both immune to constructive control by adding 
candidates. However, hybrid{£^ TSt ,£\ ast ) is susceptible to constructive control by 
adding candidates. To see that, consider the election with set C = {0, 2} of qualified 
candidates, set D = {1} of possible spoiler candidates, and voter set V consisting of 
one voter with preference order 2 > 1 > 0. Candidate loses in hybrid(£& TB t, £iast) i n 
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election (C, V): All candidate names in C are congruent to mod 2, so hybrid routes 
its input to ffirst- However, if the spoiler candidate 1 is added to C and so the election 
(C U D, V) is input to hybrid{£f\ vst , £i as t); this switches hybrid to now implement £i as tj 
and so candidate now is the unique winner of this election. Thus, hybrid (£ g rs t, £i as t) 
is not immune to constructive control by adding candidates. 

2. This claim follows immediately from Part [1] and Proposition 13. 15TT1 

3. It is easy to see that £fi rs t and £iast are immune to constructive control by partition 
and run-off partition of candidates in models TE and TP: No matter how we partition 
the candidates, there can only be winners if there is exactly one voter. And in an 
election with one voter, the first-ranked (respectively, last-ranked) candidate is the 
unique winner of the election for all partitions of candidates in all partitioning models. 

However, hybrid(£{[ rs t, £iast) is susceptible to constructive control by partition and run- 
off partition of candidates in models TE and TP. To see that, consider the election 
with candidate set C = {0, 1, 2}, distinguished candidate 2, and voter set V consisting 
of one voter with preference order 2 > 1 > 0. On input (C,V), hybrid(Ef aS f > £last) 
routes the election to £i as t, so is the unique winner of the election. Now consider the 
candidate partition C% = {0, 1} and Ci = {2}. Then is the unique winner of (C±, V) 
and 2 is the unique winner of (C2,V). So, in both partition and run-off partition of 
candidates in models TE and TP, the final round of the election is ({0, 2}, V). Since 
all candidate names are congruent to mod 2, hybrid routes its input to £fi rs t, so 2 is 
the unique winner. Since 2 has been turned from a nonwinner into a unique winner, it 
follows that hybrid(£ ft rs t, £i as t) is susceptible to constructive control by partition and 
run-off partition of candidates in models TE and TP. 

4. The argument given at the start of Part [3] of this proof also shows that £fi rs t and <£T last 
are immune to destructive control by partition and run-off partition of candidates 
in models TE and TP. To show that hybrid(£f\ rs t, £i as t) is susceptible to destructive 
control by partition and run-off partition of candidates in models TE and TP, it 
suffices to note that the candidate partition of Part [3] of this proof turns candidate 
from a unique winner into a nonwinner. 

□ 

3.4 Vulnerability 

hybrid strongly inherited resistance, which is precisely what one wants, since that is both 
the aesthetically pleasing case and broadens resistance to control. However, for vulnerability 
it is less clear what outcome to root for. Inheritance would be the mathematically more 
beautiful outcome. But on the other hand, what inheritance would inherit is vulnerability, 
and vulnerability to control is in general a bad thing — so maybe one should hope for "Not 
I(nherits)" entries for our tables in this column. In fact, our results here are mixed. In 
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particular, we for ten cases prove that inheritance holds unconditionally and for ten cases 
prove that inheritance holds (though in some cases we have to limit ourselves to election 
systems with winner /unique winner problems that fall into the polynomial hierarchy) if and 
only if P = NP. Since any practically useful election system should have winner /unique 
winner problems in P, this is not an onerous limitation. Indeed, even such "difficult" election 
systems as those of Dodgson, Kemeny, and Young have winner/unique winner problems in 
the polynomial hierarchy. 

We start with two vulnerability results that can be established by direct algorithmic 
attacks. 

Theorem 3.19 hybrid inherits vulnerability to both constructive and destructive control by 
adding candidates. 

Proof. We start with the constructive case. Let k € N + and let £q, £\, . . . , £k-\ be 
candidate-anonymous election systems each vulnerable to constructive control by adding 
candidates. Let Aj, < i < k — 1, be the polynomial-time algorithms showing that £j is 
vulnerable to constructive control by adding candidates. 

Since £$ is vulnerable to constructive control by adding candidates, £q is suscepti- 
ble to constructive control by adding candidates, and it follows from Theorem 13.11 that 
hybrid(£o,£i, . . . ,£k-i) is susceptible to constructive control by adding candidates. 

To complete our proof of vulnerability, we turn to seeking a polynomial-time algorithm 
for this control problem. Given an instance of Constructive Control by Adding Candidates, 
let Q be the set of qualified candidates with c € Q being the distinguished candidate, let S 
be the set of spoiler candidates, and let V be the voter set with preferences over QuS. We 
distinguish the following three cases. 

Case 1: Not all candidates in Q have the same value modulo k. Then, regardless of 
whether none, some, or all candidates from S are added, the initial and final elec- 
tion will be routed by hybrid(£o,£i, ■ ■ ■ , £k-i) to ^default = Thus, we can simply 
invoke algorithm Ak-i- 

Case 2: All candidates in Q have the same value modulo k, call it q, and all candidates 
in S also have values congruent to q mod k. Then we simply invoke algorithm A q . 

Case 3: All candidates in Q have the same value modulo k, call it q, and at least one 
candidate in S has a value not congruent to q mod k. Then we do the following: 

Step 1: Invoke A q to see if victory (i.e., being the unique winner) for c is possible in 
£ q with Q as the set of qualified candidates, S q as the set of spoiler candidates, 
where S q contains all members of S whose values are congruent to q mod k, and 
with voter set V (restricted to the participating candidates). If algorithm A q 
says YES, then output YES and halt; otherwise go to StepEJ 

Step 2: For each d £ S H {i \ i ^ q mod k}, invoke Ak-i to see if victory for 
c is possible in default = £fc-i with Q U {d} as the set of qualified candidates, 
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S' = S—{d} as the set of of spoiler candidates, and with voter set V. If algorithm 
Ak-\ says YES, then output YES and halt; otherwise go to the next iteration of 
this for-each loop. 

Step 3: If we reach this step (i.e., the for-each loop in Step [2] was not successful in 
any of its iterations), then output "victory for c is impossible" and halt. 

Note that the reason we in Case [3] had to include the "try each non-mod-q 1 as being 
forced in" nourish is that only when at least one non-mod-g candidate is in the candidate 
set will we switch from £ q to default , so we must be very careful to only use £ default regarding 
cases that will be routed to it. We cannot in any obvious way replace the loop with a single 
test, as a single vulnerability test does not let us address "Is there some subset of the spoiler 
set that includes at least one marked spoiler and that makes c win?" as that is a different 
problem, though the algorithm in effect does that via a polynomial number of ordinary 
vulnerability tests. 

As to the destructive case, it follows from Theorem 13.11 that hybrid(£o, 8i, . . . , £k-i) 
is susceptible to destructive control by adding candidates. To show that vulnerability 
inherits, exactly the same algorithm as above works, except with each time "victory" occurs 
replaced with "not being a unique winner," and of course when we now call the underlying 
polynomial-time algorithms for £j, they will be for the case of destructive control by adding 
candidates. □ 

We now state eight trivial inheritance cases. 

Theorem 3.20 Vulnerability to constructive and destructive control by adding voters, 
deleting voters, partition of voters in model TE, and partition of voters in model TP are all 
inherited by hybrid. 

Proof. None of these operations changes the candidate set, so whatever system hybrid 
routes the input to {£q or £ i or . . . or £k-i or ^default = £fc-i) will handle all the election 
evaluations related to the given input, and so we can directly use its polynomial-time 
algorithm showing vulnerability to the given type of control. Susceptibility follows from 
Theorem 13.11 □ 

We are down to ten cases — deleting candidates and the four candidate-based partition 
cases, with each of those five cases appearing in constructive control and destructive control 
versions. For these ten cases, we will prove that inheritance holds (though in some cases 
we have to limit ourselves to election systems whose winner/unique winner problems are in 
the polynomial hierarchy) if and only if P = NP. 

Theorem 3.21 Let <3? be one of the following two control types: 

1. constructive control by deleting candidates, 

2. destructive control by deleting candidates, 
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let k £ N + ; and let £q, £\, . . . , £k-i be election systems whose ^-control problems are in 
the polynomial hierarchy and such that for at least one i, < i < k — 1, £% is candidate- 
anonymous and susceptible to If P = NP then hybrid(£o, £\, . . . , £k-i) is vulnerable 
to 

Proof. It follows immediately from Theorem 13.11 that hybrid(£o, £i, . . . , £k-\) is suscepti- 
ble to To show vulnerability, note that for constructive control by deleting candidates the 
unique winner problem <m-reduces (via the trick mentioned in Section 12.41 asking about 
deleting zero candidates) to the control problem. And for destructive control by deleting 
candidates, by the same trick, we have that the unique winner problem <m-reduces to the 
complement of the control problem. So in both cases, since P = NP is assumed and the con- 
trol problems are assumed to be in the polynomial hierarchy, we do have a polynomial-time 
algorithm for hybrid(£o, £\, . . . , £fc_x)'s unique winner problem by Proposition 12.61 Now, 
guess every possible way of legally deleting candidates and using the polynomial-time algo- 
rithm for hybrid(£Q,£i, . . . , £k-i) see if under some such way our goal (making a specified 
candidate the unique winner or precluding a specified candidate from being a unique win- 
ner) can be achieved. This is an NP algorithm but since P = NP it proves vulnerability 
to □ 



Corollary 3.22 // P = NP then hybrid inherits vulnerability to constructive and destruc- 
tive control by deleting candidates. 

On the other hand, we have the following result. Since the reader has earlier in this 
paper seen many examples of our resistance proofs and has just seen some vulnerability- 
related constructions, for the rest of this section we defer the proofs to Appendix HI 

Theorem 3.23 There exist candidate- anonymous election systems £q and £\ that are vul- 
nerable to constructive control by deleting candidates but such that hybrid(£o,£i) is resistant 
to constructive control by deleting candidates. 

From Corollary 13.221 Theorem 13.231 and the fact that if P ^ NP then resistance implies 
nonvulnerability, we have our characterization. 

Corollary 3.24 P = NP if and only if hybrid inherits vulnerability to constructive control 
by deleting candidates. 

The corresponding characterization for the case of destructive control by deleting can- 
didates will be established later as Corollary 13.371 We note that the proof of Theorem 13.231 
also immediately establishes the following, by taking £q = £ nu \\, the election system in which 
all candidates always lose. 

Corollary 3.25 There exist candidate- anonymous election systems £q and £\ such that £q 
is immune to constructive control by deleting candidates and £\ is vulnerable to constructive 
control by deleting candidates but such that hybrid(£o,£i) is resistant to constructive control 
by deleting candidates. 
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Unfortunately, the analogs of Theorem 13.211 for candidate-related partitions are less 
clean. Regarding the strengths in the hypotheses in the following theorem, we mention 
that when a winner problem is in the polynomial hierarchy, that clearly implies that the 
corresponding unique winner problem is in the polynomial hierarchy. 

Theorem 3.26 1. Let <5 be one of the following four control types: 

(a) constructive control by partition of candidates in model TP, 

(b ) destructive control by partition of candidates in model TP, 

(c) constructive control by run- off partition of candidates in model TP, 

(d) destructive control by run- off partition of candidates in model TP, 

let k G N + , and let £q,£i, . . . ,£k-i be election systems such that for at least one i, 
< i < k — 1, £% is candidate- anonymous and susceptible to <]?. If V = NP and 
the winner problem for hybrid(£Q,£\, . . . ,£k~i) is in the polynomial hierarchy, then 
hybrid(£o,£\, . . . ,£k~i) is vulnerable to <£. 

2. Let be one of the following four control types: 

(a) constructive control by partition of candidates in model TE, 

(b ) destructive control by partition of candidates in model TE, 

(c) constructive control by run- off partition of candidates in model TE, 

(d) destructive control by run- off partition of candidates in model TE, 

let k £ N + ; and let £o,£i, ■ ■ ■ ,£k-i be election systems such that for at least one i, 
< i < k — 1, £i is candidate- anonymous and susceptible to If V = NP and 
the unique winner problem for hybrid(£o, £\, . . . , £k-i) is in the polynomial hierarchy, 
then hybrid(£o,£i, . . . -,£k-i) is vulnerable to 

In light of Proposition 12.61 Theorem 13.261 certainly implies the following weaker but 
more naturally formed result. 

Corollary 3.27 1. Let $ be one of the following four control types: 

(a) constructive control by partition of candidates in model TP, 

(b ) destructive control by partition of candidates in model TP, 

(c) constructive control by run- off partition of candidates in model TP, 

(d) destructive control by run- off partition of candidates in model TP, 

let k G N + , and let £o,£\, . . . ,£k-i be election systems such that for at least one i, 
< i < k — 1, £i is candidate- anonymous and susceptible to <£. If V = NP and 
the winner problems for each of £q, £±, . . . , £k-i are in the polynomial hierarchy, then 
hybrid(£o,£\, . . . ,£k-i) is vulnerable to 
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2. Let $ be one of the following four control types: 

(a) constructive control by partition of candidates in model TE, 

(b ) destructive control by partition of candidates in model TE, 

(c) constructive control by run- off partition of candidates in model TE, 

(d) destructive control by run- off partition of candidates in model TE, 

let k £ N + , and let £o,£i, . . . ,£k-i be election systems such that for at least one i, 
< i < k — 1, £i is candidate- anonymous and susceptible to <£. If P = NP and the 
unique winner problems for each of £q,£i, . . . ,£k-i are in the polynomial hierarchy, 
then hybrid(£o,£x, . . . ,£k-i) is vulnerable to <E>. 

On the other hand, we have the following result. 

Theorem 3.28 There exist candidate- anonymous election systems £q and £\ that are vul- 
nerable to constructive control by run- off partition of candidates (in models TE and TP) but 
such that hybrid(£o,£i) is resistant to constructive control by run- off partition of candidates 
(in models TE and TP). 

Corollary 3.29 //P ^ NP then hybrid does not inherit vulnerability to constructive control 
by run- off partition of candidates in model TE or TP. 

Corollaries 13.271 and 13.291 certainly imply the following result. 

Corollary 3.30 1. The following are equivalent. 

(a) hybrid inherits vulnerability to constructive control by run- off partition of can- 
didates in model TE on election systems having unique winner problems in the 
polynomial hierarchy. 

(b) hybrid strongly inherits vulnerability to constructive control by run- off partition 
of candidates in model TE on election systems having unique winner problems in 
the polynomial hierarchy. 

(c) P = NP. 

2. The following are equivalent. 

(a) hybrid inherits vulnerability to constructive control by run- off partition of candi- 
dates in model TP on election systems having winner problems in the polynomial 
hierarchy. 

(b) hybrid strongly inherits vulnerability to constructive control by run- off partition 
of candidates in model TP on election systems having winner problems in the 
polynomial hierarchy. 

(c) P = NP. 
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We note that the proof (in Appendix [A} of Theorem 13.281 also immediately establishes 
the following, by taking £q = £ nu n, the election system in which all candidates always lose. 

Corollary 3.31 There exist candidate- anonymous election systems £q and £\ such that £q 
is immune to constructive control by run- off partition of candidates (in models TE and TP) 
and £\ is vulnerable to constructive control by run- off partition of candidates (in models TE 
and TP) but such that hybrid(£o,£i) is resistant to constructive control by run- off partition 
of candidates (in models TE and TP). 

We now turn to the analogs of Theorem 13.281 and Corollaries 13.291 13.301 and 13.311 for 
constructive control by partition of candidates. 

Theorem 3.32 There exist candidate- anonymous election systems £q and £\ that are vul- 
nerable to constructive control by partition of candidates (in models TE and TP) but such 
that hybrid(£o,£i) is resistant to constructive control by partition of candidates (in models 
TE and TP). 

Corollary 3.33 //P/ NP then hybrid does not inherit vulnerability to constructive control 
by partition of candidates in model TE or TP. 

Corollaries 13.271 and 13.331 certainly imply the following result. 

Corollary 3.34 1. The following are equivalent. 

(a) hybrid inherits vulnerability to constructive control by partition of candidates in 
model TE on election systems having unique winner problems in the polynomial 
hierarchy. 

(b) hybrid strongly inherits vulnerability to constructive control by partition of can- 
didates in model TE on election systems having unique winner problems in the 
polynomial hierarchy. 

(c) P = NP. 

2. The following are equivalent. 

(a) hybrid inherits vulnerability to constructive control by partition of candidates in 
model TP on election systems having winner problems in the polynomial hierar- 
chy. 

(b) hybrid strongly inherits vulnerability to constructive control by partition of candi- 
dates in model TP on election systems having winner problems in the polynomial 
hierarchy. 

(c) P = NP. 

We note that the proof (in Appendix E} of Theorem 13.321 also immediately establishes 
the following, by taking £q = £ nu \\, the election system in which all candidates always lose. 



37 



Corollary 3.35 There exist candidate- anonymous election systems £q and £\ such that £q 
is immune to constructive control by partition of candidates (in models TE and TP) and 
£\ is vulnerable to constructive control by partition of candidates (in models TE and TP) 
but such that hybrid(£o, £\) is resistant to constructive control by partition of candidates 
(in models TE and TP). 

We now turn to the destructive control cases. 

Theorem 3.36 There exist candidate- anonymous election systems £q and £\ that are vul- 
nerable to destructive control by deleting candidates, partition of candidates (in models 
TE and TP), and run- off partition of candidates (in models TE and TP), but such that 
hybrid(£o, £%) is resistant to destructive control by deleting candidates, partition of candi- 
dates (in models TE and TP), and run- off partition of candidates (in models TE and TP). 

From Corollary 13.221 Theorem 13.361 and the fact that if P ^ NP then resistance implies 
nonvulnerability, we obtain a complete characterization of the destructive control by deleting 
candidates case. 

Corollary 3.37 P = NP if and only if hybrid inherits vulnerability to destructive control 
by deleting candidates. 

Recall that we don't quite have the analog of Corollary 13.221 for the partition cases. 
Theorem 13.361 established the following implication. 

Corollary 3.38 //P / NP then hybrid does not inherit vulnerability to destructive control 
by partition of candidates (in models TE and TP) and run- off partition of candidates (in 
models TE and TP). 

Corollaries 13.271 and 13.381 certainly imply the following result. 

Corollary 3.39 1. The following are equivalent. 

(a) hybrid inherits vulnerability to destructive control by partition of candidates in 
model TE on election systems having unique winner problems in the polynomial 
hierarchy. 

(b) hybrid strongly inherits vulnerability to destructive control by partition of can- 
didates in model TE on election systems having unique winner problems in the 
polynomial hierarchy. 

(c) P = NP. 

2. The following are equivalent. 

(a) hybrid inherits vulnerability to destructive control by partition of candidates in 
model TP on election systems having winner problems in the polynomial hierar- 
chy. 
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(b) hybrid strongly inherits vulnerability to destructive control by partition of candi- 
dates in model TP on election systems having winner problems in the polynomial 
hierarchy. 

(c) P = NP. 

3. The following are equivalent. 

(a) hybrid inherits vulnerability to destructive control by run- off partition of can- 
didates in model TE on election systems having unique winner problems in the 
polynomial hierarchy. 

(b) hybrid strongly inherits vulnerability to destructive control by run- off partition 
of candidates in model TE on election systems having unique winner problems in 
the polynomial hierarchy. 

(c) P = NP. 

4- The following are equivalent. 

(a) hybrid inherits vulnerability to destructive control by run- off partition of candi- 
dates in model TP on election systems having winner problems in the polynomial 
hierarchy. 

(b) hybrid strongly inherits vulnerability to destructive control by run- off partition 
of candidates in model TP on election systems having winner problems in the 
polynomial hierarchy. 

(c) P = NP. 

We note that the proof (in Appendix |Aj) of Theorem 13.361 also immediately establishes 
the following, by taking £q to be the election system where c wins if and only if c is first in 
the first voter. 

Corollary 3.40 There exist candidate- anonymous election systems £q and £\ such that £q 
is immune to destructive control by deleting candidates, partition of candidates (in models 
TE and TP), and run- off partition of candidates (in models TE and TP), (in models TE 
and TP) and E\ is vulnerable to to destructive control by deleting candidates, partition 
of candidates (in models TE and TP), and run- off partition of candidates (in models TE 
and TP), but such that hybrid(£o, £{) is resistant to destructive control by deleting candi- 
dates, partition of candidates (in models TE and TP), and run- off partition of candidates 
(in models TE and TP). 

4 Conclusions 

Tables Q] and [2] summarize our inheritance results. The main contribution of this paper is 
the hybrid system, the fact that hybrid strongly inherits resistance, and the consequence 
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that there is an election system that resists all twenty standard types of electoral control. 
A very natural direction for future research is to broadly explore the control behavior of 
standard election systems, and in particular to see if any exhibit broad resistance to control. 
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A Deferred Proofs from Section 13.41 

We now give the proofs deferred from Section f3.4l 

Proof of Theorem 13.231 In £q, each candidate wins if and only if it is the only candi- 
date. Clearly, £q is candidate-anonymous and susceptible to constructive control by deleting 
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candidates, and it is a polynomial-time task to decide when control can be asserted, so £$ 
is vulnerable to this type of control. 

Election system £\ is defined as follows. For each candidate c G C, c wins election 
(C, V) if and only if \\V \\ > 2, c is ranked first by the first voter in V (recall that V is input 
as a list, and so it is meaningful to speak of the first voter), and (c is ranked first by the 
second voter in V or c is ranked first or second by all voters). It is immediate that £\ is 
candidate-anonymous and susceptible to constructive control by deleting candidates. The 
following polynomial-time algorithm shows that £\ is vulnerable to constructive control by 
deleting candidates: 

Step 1: Given an instance (C,c,V,k) of Constructive Control by Deleting Candidates, if 
||V|| < 2, then reject and halt. Otherwise, let C\ be the set of all candidates preferred 
to c by the first voter of V and let C2 be the set of all candidates preferred to c by 
the second voter of V. 

Step 2: If || Ci U C2II < k then accept and halt (c can be made the unique winner by 
deleting C\ U C 2 ). 

Step 3: If \C\ U C 2 || > k + 1 then reject and halt (to ensure that c is the unique winner, it 
is necessary (but not sufficient) to delete all candidates in C\ and all but one of the 
candidates in C 2 ). 

Step 4: If ||Ci U C2II = A; + 1 then for each d € C 2 , consider the election with candidates 
(C — (Ci U C2)) U {d} and voters V. If c wins this election (i.e., is in first or second 
position for each voter), then accept and halt. 

Step 5: If none of the iterations of the for-each loop in Step H] was successful, then reject 
and halt. 

It remains to prove that hybrid(£o,£i) is resistant to constructive control by deleting 
candidates. Susceptibility follows from Theorem 13.11 To show NP-hardness, we provide 
a <m-reduction from the standard NP-complete problem Vertex Cover (see Garey and 
Johnson (56J), which is defined as follows: 

Vertex Cover 

Given: An undirected, simple graph G and a positive integer k. 

Question: Does G have a vertex cover of size at most k, i.e., does there exist a subset V' 
of G's vertex set such that ||V'|| < k and V contains at least one vertex of each edge 
in Gl 

Given an instance (G, k) of Vertex Cover, create an instance (C, 0, V, k) of Constructive 
Control by Deleting Candidates for election system hybrid(£o,£i) as follows. Let G have n 
vertices and m edges. Without loss of generality, let the vertices of G be 2, 4, ... , 2n. The 
candidate set is defined by C = {0, 1, 2, 4, 6, ... , 2n}, where is the distinguished candidate, 



45 



1 is the candidate whose presence determines whether hybrid routes its input to £q or 8±, 
and 2, 4, 6, . . . , 2n are candidates corresponding to the vertices of G. The voters in V are 
defined as follows: 

1. The first voter has preference > • • • , 

2. the second voter has preference 1 > > • • • , and 

3. there are m additional voters, corresponding to the edges of G: For every edge {i,j} 
in G with i < j, we add a voter with preference i > j > > • • ■ . 

In all the above preferences, the remaining candidates follow in some arbitrary order. 
Clearly, this transformation is polynomial-time computable. To show that Vertex Cover 
<m-reduces to Constructive Control by Deleting Candidates for hybrid(£a,£i), we prove 
the following claim. 

Claim A.l G has a vertex cover of size < k (k < n) if and only if candidate can be 
made the unique winner of election (C, V) with respect to system hybrid(£Q,£i) by deleting 
at most k candidates. 

Proof of Claim [A. 11 From left to right: Delete the candidates corresponding to a vertex 
cover of G. Since candidate 1 has not been deleted, hybrid(£o,£i) routes its input to the 
system £ default = £\- Thus, candidate is the unique winner. 

From right to left: If candidate is the unique winner after at most k candidates have 
been deleted, candidate 1 cannot be among the deleted candidates. (Note that otherwise 
hybrid(£o,£\) would have routed its input to the system £q, and since after deleting at 
most k < n candidates at least two candidates remain, no one would have won in £q.) Since 
candidate 1 is ranked first by the second voter, it follows that candidate must be ranked 
first or second by all voters. This means that the set of deleted candidates corresponds to 
a vertex cover of G having size at most k. □ Claim [A7T1 

This completes the proof. □ Theorem 13.231 

Proof of Theorem 13.261 The proof is similar to the proof of Theorem 13.211 In all eight 
cases, it follows immediately from Theorem 13.11 that hybrid(£o, £±, . . . , £k-i) is suscepti- 
ble to $. Since P = NP and the winner problem in each of Case [Ta| through [id] and the 
unique winner problem in each of Case I2al through I2dl for hybrid(£o,£\, . . . is in the 

polynomial hierarchy, we have a polynomial-time algorithm for hybrid(£o, £\, . . . , £fc_i)'s 
winner problem in each of Case [la] through [Id] and a polynomial-time algorithm for 
hybrid(£o,£\, . . . ,£fc_i)'s unique winner problem in each of Case [2al through [2dl 

To prove vulnerability to the given control type nondeterministically guess every 
possible way of partitioning the candidate set and use the polynomial-time algorithm for 
hybrid(£o,£\, . . . , £"fc_i)'s winner problem if ties in subelections are handled by TP and use 
the polynomial-time algorithm for hybrid(£o,£i, . . . ,£fc_i)'s unique winner problem if ties 
in subelections are handled by TE to determine which candidates participate in the final 
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round of the election. Then use a polynomial-time algorithm for the unique winner problem 
(note that when a winner problem is in P, that clearly implies that the corresponding unique 
winner problem is in P) to determine if the distinguished candidate is the unique winner 
of the (final round of the) election for constructive control cases, and if the distinguished 
candidate is not a unique winner of the (final round of the) election for destructive control 
cases. □ Theorem 13.261 

Proof of Theorem 13.281 Let £q be the election system in which each candidate c is a 
winner if and only if c is the only candidate and there is only one voter. This artificial elec- 
tion system is clearly vulnerable to constructive control by run-off partition of candidates. 
To define £\, we modify election system E\ from the proof of Theorem l3.23l Here, we define 
E\ to be the following artificial election system: For each candidate c £ C, c wins election 
(C, V) if and only if 

1. for some integer n > 0, ||V|| = 1 + n(n — l)/2 and ||C|| < (n + 3)/2, and 

2. c is ranked first by the first voter in V and c is ranked first or second by all voters. 

It is immediate that £q and £\ are candidate-anonymous. Note that tie-handling issues 
do not apply, since So and E\ never have ties. It is easy to see that £\ is susceptible to 
constructive control by run-off partition of candidates. We now describe a polynomial-time 
algorithm to decide if this type of control can be asserted. 

Given an instance (C, c, V) of Constructive Control by Run-off Partition of Candidates, 
first check that for some integer ra > 0, ||V|| = 1 + n(n — l)/2. If not, for no partition of 
candidates is c the unique winner. 

If ||V|| = 1 + n(n — l)/2 for some integer n > 0, we claim that c is the unique winner in 
partition ({c},C — {c}) if and only if there is a candidate partition (C±,C2) in which c is 
the unique winner. This proves that Ex's control problem is in P, since checking if c is the 
unique winner in ({c}, C — {c}) can be done in polynomial time. 

To prove the nontrivial direction of our claim, suppose that c is the unique winner in par- 
tition (Ci, C2) where c G C±, but that c is not the unique winner in partition ({c}, C — {c}). 
Since c is the unique winner of ({c}, V), there is a candidate d € C — {c} such that d is the 
unique winner of (C — {c},^) and such that c is not the unique winner of ({c, d},V). It 
follows that d is ranked first by the first voter. If d € C±, then c is not the unique winner of 
(Ci, V), which contradicts the assumption that c is the unique winner in partition (Ci, C2). 
If d G C2, then d is the unique winner of (C2, V) (since C2 Q C — {c} and d is the unique 
winner of (C — {c}, V)). It follows that the final run-off is ({c, d}, V). Since d is ranked 
first by the first voter, c does not win the final run-off, contradicting the assumption that 
c is the unique winner in partition (Ci, C2). 

It remains to prove that hybrid(£o,£i) is resistant to constructive control by run-off 
partition of candidates. Susceptibility follows from Theorem 13.11 To show NP-hardness 
of the control problem, we provide a reduction from the problem Odd Half Vertex Cover, 
which is a minor modification of Vertex Cover and is defined as follows: 
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Odd Half Vertex Cover 



Given: An undirected, simple graph G with an odd number n > 1 of vertices. 
Question: Does G have a vertex cover of size (n + l)/2? 

Standard padding can be used to show that Odd Half Vertex Cover is NP-hard (see, for 
example, \60\ Problem 7.22]). The reduction from Odd Half Vertex Cover to Construc- 
tive Control by Run-off Partition of Candidates is similar to the reduction from Vertex 
Cover to Constructive Control by Deleting Candidates, which was presented in the proof 
of Theorem 

Given an instance G of Odd Half Vertex Cover, create an instance (C, 0, V) of Con- 
structive Control by Run-off Partition of Candidates for election system hybrid(£o,£i) as 
follows. Let G have n > 1 vertices, n odd. Without loss of generality, let the vertices of 
G be 2, 4, ... , In. The candidate set is defined by C = {0, 1, 2, 3, 4, 6, 8, . . . , 2n}, where 
is the distinguished candidate, 1 and 3 are candidates whose presence determines whether 
hybrid routes its input to £q or £±, and 2, 4, 6, . . . , 2n are candidates corresponding to the 
vertices of G. The 1 + n(n — l)/2 voters in V are defined as follows: 

1. The first voter has preference > 3 > • • • , 

2. for every edge {i, j} in G with i < j, we add a voter with preference 3>i>j>0> 
• • • , and 

3. add duplicates of the first voter until there are exactly 1 + n(n — l)/2 voters. 

In the above preferences, the remaining candidates follow in some arbitrary order. Clearly, 
this transformation is polynomial-time computable. To show that Odd Half Vertex Cover 
<m-reduces to Constructive Control by Run-off Partition of Candidates for hybrid(£o,£i), 
we prove the following claim. 

Claim A. 2 G has a vertex cover of size (n+l)/2 if and only if candidate can be made the 
unique winner of election (C, V) with respect to system hybrid(£o,£i) by run- off partition 
of candidates. 

Proof of Claim IA.21 From left to right: Let C' C {2, 4, 6, ... , 2n} be a vertex cover of 
G of size (n + l)/2. Consider candidate partition C2 = {3} U C' and C\ = C — Ci- Note 
that ||Ci|| = HC2II = (n + 3)/2. Also note that both subelections are routed to £\. It is 
immediate that 3 is the unique winner of (C2, V). Since C' is a vertex cover of G, is the 
unique winner of (C\,V). It is immediate that is the unique winner of the final run-off 

({o,3},n 

From right to left: Suppose is the unique winner in partition (Ci,C2) where € C\. 
Then subelection {C\, V) and the final run-off need to involve candidates from {1, 3} (since 
||V|| 7^ 1, subelections routed to £q will not have winners). It follows that is the unique 
winner of {C\, V), that 1 or 3 is the unique winner of (C2, V), and that exactly one of 1 or 3 is 
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inCi. Since both subelections have unique winners, it follows that ||Ci|| = [| [] = (n+3)/2. 
Since is the unique winner of (Ci, V), the vertex candidates that are not in C\ (i.e., that 
are in C 2 ) form a vertex cover of G. C 2 contains exactly (n + 3)/2 — 1 = (n + l)/2 vertex 
candidates. So, G has a vertex cover of size (n + l)/2. □ Claim IA721 

This completes the proof. □ Theorem 13.281 

Proof of Theorem 13.321 As in the proof of Theorem 13.281 let £q be the election system 
in which each candidate c is a winner if and only if c is the only candidate and there is 
only one voter. This artificial election system is clearly vulnerable to constructive control 
by partition of candidates. To define £\, we modify election system £\ from the proof of 
Theorem 13.281 Here, we define £\ to be the following artificial election system: For each 
candidate c € C, c wins election (C, V) if and only if 

1. for some even integer n > 0, ||V|| = 1 + n(n — l)/2 and ||C|| G {1, n/2 + 2}, and 

2. c is ranked first by the first voter in V and c is ranked first or second by all voters. 

It is immediate that £q and £\ are candidate-anonymous. Note that tie-handling issues 
do not apply, since £q and E\ never have ties. It is easy to see that £\ is susceptible 
to constructive control by partition of candidates. We now describe a polynomial-time 
algorithm to decide if this type of control can be asserted for £\ . 

Given an instance (C, c, V) of Constructive Control by Partition of Candidates, first 
check that for some even integer n > 0, ||V|| = 1 + n(n — l)/2. If not, for no partition of 
candidates is c the unique winner. 

If ||V|| = l + n(n— l)/2 for some even integer n > 0, first check if c is the unique winner 
in partition (C — {c}, {c}). Now suppose that c is not the unique winner in this partition. 
Since c is the unique winner of ({c}, V), it follows that (C — {c}, V) has a winner, which 
implies that \\C - {c}\\ G {I, n/2 + 2}, i.e., ||C|| € {2, n/2 + 3}. 

Note that if c is the unique winner in partition (Ci, C2), one of the following cases holds: 

1. ceCi and ||Ci|| G {l,n/2 + 2}, 

2. cGC 2 and ||C 2 || G {l,n/2 + 2}, or 

3. cGC 2 and ||C 2 || = n/2 + 1. 

Since ||C|| G {2, n/2 + 3}, we can enumerate all partitions (C\, C 2 ) that satisfy one of these 
cases in polynomial time. Control can be asserted if and only if c is the unique winner for 
one of these partitions. 

It remains to prove that hybrid(£o,£i) is resistant to constructive control by partition of 
candidates. Susceptibility follows from Theorem 13.11 To show NP-hardness of the control 
problem, we provide a reduction from the NP-complete problem Even Half Vertex Cover, 
a minor variation of the problem Odd Half Vertex Cover that was used in the proof of 
Theorem E^HJ 
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Even Half Vertex Cover 

Given: An undirected, simple graph G with an even number re > of vertices. 
Question: Does G have a vertex cover of size re/2? 

The reduction from Even Half Vertex Cover to Constructive Control by Partition of Can- 
didates is similar to the reduction from Odd Half Vertex Cover to Constructive Control by 
Run-off Partition Candidates, which was presented in the proof of Theorem 13.281 

Given an instance G of Even Half Vertex Cover, create an instance (C, 0, V) of Con- 
structive Control by Partition of Candidates for election system hybrid(So,Si) as follows. 
Let G have re > vertices, re even. Without loss of generality, let the vertices of G be 
2,4,..., 2re. The candidate set is defined by C = {0, 1, 2, 4, 6, 8, ... , 2re}, where is the dis- 
tinguished candidate, 1 is the candidate whose presence determines whether hybrid routes 
its input to So or Si, and 2,4, 6, . . . , 2re are candidates corresponding to the vertices of G. 
The 1 + n(re — l)/2 voters in V are defined as follows: 

1. The first voter has preference > 1 > • • • , 

2. for every edge {i, j} in G with i < j, we add a voter with preference i > j > > • • ■ , 
and 

3. add duplicates of the first voter until there are exactly 1 + n(re — l)/2 voters. 

In the above preferences, the remaining candidates follow in some arbitrary order. Clearly, 
this transformation is polynomial-time computable. To show that Even Half Vertex Cover 
<m-reduces to Constructive Control by Partition of Candidates for hybrid(So,Si), we prove 
the following claim. 

Claim A. 3 G has a vertex cover of size re/2 if and only if candidate can be made the 
unique winner of election (C, V) with respect to system hybrid(So,Si) by partition of can- 
didates. 

Proof of Claim IA.3L From left to right: Let C' C {2, 4, 6, ... , 2n} be a vertex cover of 
G of size re/2. Consider candidate partition C\ = C' and C2 = C — C\. Note that (Ci, V) 
has no winners, since hybrid routes this election to Sq. Since C' is a vertex cover of G and 
IIC2II = n /2 + 2, is the unique winner of (C2, V), and thus of the whole election. 

From right to left: Suppose is the unique winner in partition (Ci, C2). Then certainly 
is the unique winner of some subelection. Note that re > and re is even implies || V|| > 1. 
So, in order for to win a subelection, the subelection must be routed to Si, which implies 
that 1 participates in the subelection. But this implies that the number of candidates 
involved in the subelection is re/2 + 2 and is ranked first or second by all voters. It follows 
that the set of candidates not involved in the subelection form a vertex cover of G, and this 
vertex cover is of size re/2. □ Claim [A3l 

This completes the proof. □ Theorem 13.321 
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Proof of Theorem 13.361 In 8q, each candidate c wins if and only if there is at least 
one voter and c is ranked first by the first voter and (there are at least two voters or there 
are at least two candidates). This artificial system is clearly candidate-anonymous and it 
is easy to see that £q is susceptible to destructive control by deleting candidates, partition 
of candidates (in models TE and TP), and run-off partition of candidates (in models TE 
and TP): Consider an election with two candidates, c and d, and one voter, c > d. Then c 
is the unique winner of the election, but deleting d or partitioning {c, d} into {c} and {d} 
will ensure that c does not win. To show vulnerability, note that distinguished candidate c 
can be made not a unique winner of (C, V) if and only if ||V|| = or c is not ranked first 
by the first voter or ||V|| = 1 (in the latter case by deleting all candidates other than c, or 
by partitioning the set of candidates C into C\ = {c} and C2 = C — {c}). 

In £\, for each candidate c £ C, c wins election (C,V) if and only if \\V\\ > and c 
is ranked second by the first voter and (||V|| ^ 4||C|| 2 or some voter ranks c worse than 
second). 

It is immediate that £\ is candidate-anonymous. Note that tie-handling issues do not 
apply, since £q and £\ never have ties. It is easy to see that £\ is susceptible to destructive 
control by deleting candidates, partition of candidates, and run-off partition of candidates. 
To show vulnerability, it suffices to show that we can decide in polynomial time whether 
these types of control can be asserted. 

Given an instance (C, c, V, k) of Destructive Control by Deleting Candidates, control 
can be asserted if and only if 

1. ||V|| = 0, or 

2. c is not ranked second by the first voter, or 

3. ||V r |[=4||C|| 2 and no voter ranks c worse than second, or 

4. k > 0. 

Note that if any of the first three cases holds, c does not win, so no action by the chair is 
required to assert control. On the other hand, if none of these first three cases holds, the 
chair can block c from winning exactly if k > 0, by deleting one candidate to make sure 
that c is not ranked second by the first voter. 

Given an instance (C, c, V) of Destructive Control by Partition of Candidates or of 
Destructive Control by Run-off Partition of Candidates, note that c is not a winner in 
election ({c}, V). Thus, these two types of destructive control can always be asserted, using 
partition ({c}, C — {c}). 

It remains to prove that hybrid(£o,£i) is resistant to destructive control by by deleting 
candidates, partition of candidates, and run-off partition of candidates. 

Susceptibility follows from Theorem 13.11 To show NP-hardness of the control problem, 
we provide a reduction from the NP-complete problem Even Half Vertex Cover, which was 
defined in the proof of Theorem 13.321 The reduction is similar to the reduction from Even 
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Half Vertex Cover to Constructive Control by Partition of Candidates from the proof of 
Theorem 13.321 

Given an instance G of Even Half Vertex Cover, create an instance of the relevant de- 
structive control problem for election system hybrid(£o,£i) as follows. Let G have n > 
vertices, n even. Without loss of generality, let the vertices of G be {2, 4, . . . , 2n}. The can- 
didate set is defined by C = {0, 1, 2, 4, 6, 8, ... , 2re}, where is the distinguished candidate, 
1 is the candidate whose presence determines whether hybrid routes its input to £q or £\, 
and 2, 4, 6, . . . , 2n are candidates corresponding to the vertices of G. The 4(n/2 + 2) 2 voters 
V are defined as follows: 

1. The first voter has preference 1 > > • • • , 

2. for every edge {i,j} in G with % < j, we add a voter with preference % > j > > • • ■ , 
and 

3. add duplicates of the first voter until there are exactly (n + 4) 2 = 4(n/2 + 2) 2 voters. 

In the above preferences, the remaining candidates follow in some arbitrary order. Clearly, 
this transformation is polynomial-time computable. To show that Even Half Vertex Cover 
<m-reduces to Destructive Control by Deleting Candidates, Partition of Candidates, and 
Run-off Partition of Candidates for hybrid(£o,£i), it suffices to prove the following claim. 

Claim A. 4 1. G has a vertex cover of size n/2 if and only if candidate can be made 
not a unique winner of election (C, V) with respect to system hybrid(£o,£i) by deleting 
at most n/2 candidates. 

2. G has a vertex cover of size n/2 if and only if candidate can be made not a unique 
winner of election (C,V) with respect to system hybrid(£o,£i) by partition of candi- 
dates. 

3. G has a vertex cover of size n/2 if and only if candidate can be made not a unique 
winner of election (C,V) with respect to system hybrid(£o,£\) by run- off partition of 
candidates. 

Proof of Claim IA.41 From left to right (for all three cases): Let C' C {2, 4, 6, ... , 2n} 

be a vertex cover of G of size n/2. Consider election (C — C',V). Since ||V[| = 4(n/2 + 2) 2 = 
4||C — C"|| 2 and is ranked first or second by all voters in (C — C', V), it follows that 
is not a winner of (C — C',V). Thus, destructive control can be asserted by deleting the 
n/2 candidates in C' in the deleting candidates case, and by partitioning the candidates as 
(C — C', C') in the partition and run-off partition of candidates cases. 

From right to left (for all three cases): Suppose can be made not a unique winner of 
election (C, V) by deleting candidates, or by partition of candidates, or by run-off partition 
of candidates. Then it certainly follows that for some C'CC with G C', is not a winner 
of (C, V). Note that candidate 1 must participate in election (C, V), since is the unique 



52 



winner of all subelections that don't involve 1: such elections are routed to \\V\\ > 2, 
and the first voter ranks first of the candidates in C — {1}. 

So, is not a winner of (C, V) for some C such that {0, 1} C C C C. Since (C, V) is 
routed to £\ and is ranked second by the first voter in (C, V), it follows that || V || = 4||C"|| 2 
and that is ranked first or second by all voters. The latter condition implies that the set 
of candidates not involved in the subelection, i.e., the candidates in C — C , form a vertex 
cover of G. Since ||V|| = 4(n/2 + 2) 2 and ||V|| = 4||C"|| 2 , it follows that ||C"|| = n/2 + 2, 
and thus the vertex cover of G, C — C , has size n/2. □ Claim [AT41 

This completes the proof. □ Theorem 13.361 
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